ACAS 3 Requirements RFI.xlsx

XLSX spreadsheet 38 KB Posted Apr 10, 2025

Attached to: RFI - Next Generation of the Assured Compliance Assessment Solution (ACAS)
Solicitation number: 842571649
Issued by: Defense Information Systems Agency

About this file

Written by GovTribe AI · Apr 10, 2025

This document is a Request for Information (RFI) issued by the Defense Information Systems Agency (DISA) seeking industry input for developing the next generation of the Assured Compliance Assessment Solution (ACAS), a comprehensive endpoint security scanning tool. The RFI targets a solution capable of scanning approximately 11 million devices, with scan results collected at minimum every 72 hours, and aims to sustain current on-premises capabilities while expanding into areas like Internet of Things (IoT), Operational Technology (OT), and cloud environments.

The target contract period is from November 1, 2025, through October 31, 2030, structured as a firm fixed price order with a base year and four option years. The solution must support network discovery, vulnerability scanning, configuration assessment, and compliance across diverse operating systems and device types, including Windows, UNIX/Linux, Cisco IOS, and thin-client systems. The current incumbent is Sirius Federal LLC, with the existing contract running through December 26, 2025. Interested vendors must submit a 20-page white paper response by 5 p.m. EDT on April 24, 2025, to specified DISA email addresses, with a focus on technical capabilities, deployment architecture, support processes, licensing models, and transition strategies.

View the file

Other files

File	Type	Posted
RFI ACAS Amendement 0002 .pdf	PDF	Apr 24, 2025
Attachment 2 Master Device Endpoint Record (MDER).docx	DOCX document	Apr 21, 2025
RFI ACAS Amendment 0001.pdf	PDF	Apr 21, 2025
Attachment 1 Questions and Answers.pdf	PDF	Apr 21, 2025
RFI ACAS .pdf	PDF	Apr 10, 2025

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

Critical

CRITICAL Technical Requirements		Ability to Meet	Comments
1	Network Discovery Requirements	Blank
1.1	The system shall provide an automated and reliable assessment capability. The system shall have the ability to scan all portions of the network (e.g. computers, switches, routers, and other networked devices) without human intervention. It will consistently provide an accurate inventory of the devices discovered.	Blank
1.7	The system shall provide a capability to identify host details including operating system, listening ports, protocols and open services. Open services shall be assessed against Internet Engineering Task Force (IETF) Network Endpoint Assement (NEA) defined network services.
1.19	The system shall provide an optional means to have installed agents. The agents shall be customizable to scan with administrative and non administrative privileges and not require Root/Admin privileges to operate (e.g. use of a priviledged Service Account).
1.24	The system shall identify, track, and maintain "system identity" uniqueness during assessments and data management ensuring the changes within the authoritative record are flagged when changes to the system's identity are discovered.
1.34	The system shall have the ability to scan networks in both IPv4 and IPv6 instances.
2	Automated Network Vulnerability/Compliance Scanning Requirements
2.6	The system shall provide customizable scans for specific or identified vulnerabilities or categories of configurations.
2.15	The system shall operate on one or more of the following operating systems / environment(s)
2.15.1	Windows Server Operating Systems that are currently supported by Micosoft. As of this requirement's writing the following would be supported:

-Windows Server 2016 (v1607) -Windows Server 2019 (v1809) -Windows Server 2022 -Windows Server 2025

2.15.2 Linux Server Operating Systems that are currently supported. As of this requirement's writing the following would be supported:

-Red Hat Enterprise Linux (RHEL) 8 and newer.

-CentOS Stream

2.15.3	Virtualized OS via HyperVisor (e.g. ESX/ESXi, VMWare, HyperV, etc.)
2.15.4	Containerized OS'es (e.g. Docker, Kubernetes, etc.)
3	Application Vulnerability Scanning Requirements (Web, Database, etc.)
3.1	The system shall provide a capability to assess application vulnerabilities. (e.g. Microsoft Office Suite, Browsers, Apache, Java etc.)
4	Configuration Assessment Requirements
4.6	The system shall provide a capability to assess compliance via NIST's USGCB standard(s).
4.6.1	The system shall provide the capability to assess compliance for DOD STIGs using the native OVAL and XCCDF provided on the current DOD content repository, currently Cyber.mil.
4.6.2	The system shall provide the capability to extend DOD STIGs with non-OVAL checks to provide the most complete possible assessment of automatable and semi-automatable compliance checks.
4.6.3	The system shall provide vendor compliance checklists for STIGs where available and CIS or vendor compliance checklists where STIGs are not available. Checks will expose standard XCCDF data elements to include benchmark id, profile, version, and distinct rule_id identifiers for each included check, along with results using the XCCDF results enumeration.
4.6.4	The system shall assess and report when endpoint compliance results change between compliance assessments.
4.12	The system shall provide a capability to assess patch management configurations for Windows-based systems.
4.13	The system shall provide a capability to assess patch management configurations for non-Windows based systems. Examples include:

1. Linux OS'es: RedHat Enterprise Linux, Ubuntu, CentOS, Debian.

2. UNIX OS'es: Solaris & HP-UX.

3. BSD OS'es: FreeBSD & OpenBSD.

4. Specialized OS'es: Cisco IOS & ESXi.

5. Cloud native OS'es: CoreOS & Photon OS.

4.16	The system shall provide a capability to perform website assessments.
4.17.1	The system shall provide the ability to provide authenticated scans for common network infrastructure operating systems (e.g. Cisco IOS and Juniper). Authenticated scans include scans conducted using Secure Shell, SNMP, NetConf, vendor proprietary interfaces, or other protocols where complete system data collection can be accessed and assessed for vulnerabilities and compliance.
4.18	The system shall provide a capability to provide assessments against Windows 32 bit operating systems.
4.19	The system shall provide a capability to provide assessments against Windows 64 bit operating systems.
4.2	The system shall provide a capability to provide assessments against UNIX operating systems.
4.21	The system shall provide a capability to provide assessments against LINUX operating systems.
4.22	The system shall provide a capability to provide assessments against macOS, iOS and other Apple operating systems.
4.24	The system shall provide a capability to assess DoD IAVM Notice compliance with IAVM compliance reported per specific product version and/or patch.
4.25	The system shall provide a capability to assess whether EOL/EOS operating systems are licensed for extended security updates.
4.26	The system shall assess compliance and vulnerabilities on endpoints running EOL/EOS operating systems to the last known patch or configuration issued.
4.27	The system shall assess endpoints for operating systems and applications that are EOL/EOS or have upcoming EOL/EOS events scheduled within 12 months and include advisories in assessment results.
5	Remote and Peripheral Device Configuration (Non-Agent Based)
5.1	The system shall provide a non-agent based capability to assess remote and peripheral devices (e.g. IoT & OT) and their configurations.
7	Report Generation and Data Export
7.2	The system shall provide a capability to natively display all standard or customized reports.
7.5	The system shall provide a capability to automatically export or securely (e.g. encrypted email) send the results of an automatically executed or recurring scan to a remote destination. Export format examples include: .html, .xml, .pdf, or .doc/x.
7.8	The system shall provide a capability to build customized reports based on selectable report criteria.
7.14	The system shall provide a capability to support a tiered hierarchical assessment and reporting function.
7.14.1	The system shall provide hierarchical rollup, drilldown, grouping, and filtering of DoD tags. The required tags, as outlined by the Operational Attribute Guidebook published by DoD CIO include:

1: "AREA OF OPERATIONS"

2: "OWNING ORGANIZATION” / “OWNING UNIT"

3: "ADMINISTRATION ORGANIZATION"

4: "CSSP" (CYBERSECURITY SERVICE PROVIDER)

5: "GEOGRAPHIC AOR"

6: “GEOLOCATION”

7: “OPERATIONAL AUTHORIZATION”

7.14.2	The system shall provide the ability to ingest COAMS and update hierarchies to match, including deletions, display name changes and parent/child changes
7.14.3	The system shall provide full rollup, drilldown, grouping, and filtering seamlessly between tags applied through automated processes and by users
7.17	The system shall provide a capability to support administrative input to cross reference commercially identified (i.e. National Vulnerability Database) or categorized vulnerabilities to the DoD IAVM reporting compliance requirements based on CVE ID or on patch ID.
7.27	The system shall provide a capability to support replication of detailed per-asset findings to external subscribers using an XML Schema that can export all collected data and be transformed to DoD or NIST standards using Stylesheets.
7.28	The system shall provide the capability to collect applicable data elements of the DOD Master Device Endpoint Record (MDER) and export the data to external systems through the use of APIs, JSON data exports, and/or XML data exports per 7.27 above
7.29	The system shall enforce robust access control and/or permission management for report viewing, scan scheduling, content updates, and other user and administrative functions.
9	Non-Disruptive to Normal Operations
9.2	The system shall provide a management capability to customize network assessment bandwidth utilization, throttling, or system performance impacts.
9.3	The systems shall not cause accidental denial of service attacks (DoS and DDoS) throughout its normal scanning operations/activities.
10	SCAP Compliance
10.1	The system shall export assessment and vulnerability data IAW SCAP standards in each of the following formats where appropriate:
10.1.1	Common Vulnerabilities and Exposures (CVE)
10.1.2	Common Configuration Enumeration (CCE)
10.1.3	Common Platform Enumeration (CPE)
10.1.4	Extensible Configuration Checklist Description Format (XCCDF)
10.2	The system shall import assessment and vulnerability checklists and definitions IAW SCAP standards in one or more of the following formats:
10.2.4	Extensible Configuration Checklist Description Format (XCCDF)
10.2.5	Open Vulnerability and Assessment Language (OVAL)
12	Logging/Alerting
12.4	The system shall store the results from vulnerability scans. Stored data shall contain the time of the scan, the identity of the asset that was scanned, and the scan results/findings.
13	Centralized Management
13.3	The system shall provide an open API and SDK for integration of third party data sources. API and SDK integrations shall enable external submission of data and creation of new visualizations in the solution.
13.4	The system shall provide a capability for the input of user-created compliance assessment checks without vendor involvement or integration efforts.
13.22	The system shall be updatable through online and offline (standalone) techniques.
13.23	The system shall be configurable to receive updates exclusively from a DoD-specified site.
15	Console Data Entry and Data Enrichment
15.1	Attribution Tagging or generic tagging allowing equivalent of attribution data consistent with the DOD CIO defined 7 required tags (see requirement 7.14.1).
15.2	Automated tag application based on endpoint properties (OS, IP range, installed apps, running processes, previously applied tags, plus others)
15.3	Implementation of DOD correlators being added to vendor content (e.g. IAVM identifiers)

High

HIGH Technical Requirements		Comments
1	Network Discovery Requirements
1.2	The system shall provide a capability to discover and provide a detailed network map illustrating all assets on a defined IP range across the network. Assets will be identified by common network functions such as workstation, database server, domain controller, file server, to best represent exposed attack surface required to prioritize defensive measures and remediation activities.
1.3	The system shall provide a capability to discover all devices on a network that respond to ICMP "ping" requests.
1.4	The system shall provide a capability to discover and provide a network device inventory of all devices on a defined IP range on a network.
1.5	The system shall provide a capability to identify attached virtual network devices/systems that are on-prem and/or in the cloud (e.g. cloud mounted block store solutions like Elastic Block Store or Azure Disk Storage).
1.6	The system shall provide a capability to identify and scan virtual operating systems on-prem and/or in the cloud.
1.8	The system shall provide a capability to perform passive vulnerability identification based upon network traffic analysis.
1.12	The system shall provide a capability to collect system identification information. System identification information will include Fully Qualified Domain Name, Globally Unique Identifier of the Operating System [1 per installed OS], IP address (IPv4 & IPv6), and MAC address per each scanned network interface.
1.13	The system shall provide a capability to perform passive vulnerability identification based upon network traffic analysis.
1.15	The system shall collect detailed data about OS and application vendors, names and versions and their respective installation timestamps. The solutions shall provide this data using names mapped against the SCAP CPE names to support passive vulnerability inference. All application repositories shall be inventoried, to include (for Windows) Add/Remove programs, Windows Features, Windows Store, file extensions mapped to trigger executables when double-clicked. Similar data collection shall be provided for other operating systems. Any package management systems or mobile application repositories shall be queried for "installed" applications. Installation timestamps shall be recovered where available. Where installation timestamps are not available, a "firstSeen" timestamp shall be recorded.
1.15a	The system shall collect detailed data about removed or upgraded OS and applications. Data shall include the same data elements as the inventory of installed applications.
1.16	The system shall support an agent-based capability to perform assessments and vulnerability identification through the use of dissolving, temporary, or non-persistent host-based agents or equivalent.
1.17	The system shall support non-persistent agents for non-Microsoft server and workstation OS'es (e.g. UNIX, Linux, Apple, etc.)
1.18	The system shall support non-persistent agents for Microsoft server and workstation operating systems.
1.23	The system shall provide a capability to adjust the frequency that devices are re-assessed in a range that varies from continuous scanning to a user defined time periods (e.g. daily, weekly, monthly, etc.) "Continuous" scanning may include monitoring of software event logs.
1.33	The system shall support a capability to acquire and display the network gateways for each identified asset on a per-interface basis.
1.35	The system shall provide a capability to identify when a vulnerability was first discovered, as well as highlight vulnerabilities that have persisted in the environment.
2	Automated Network Vulnerability Scanning Requirements
2.1	The system shall provide a capability to execute an automated recurring scan based upon a scheduled time period such as daily, weekly, or monthly.
2.3	The system shall provide a capability to execute an automated and recurring scan based upon a of specified groupings of devices such as mission assignment, organization, system type, MAC level, application type etc.
2.4	The system shall provide a quantifiable (i.e. numeric and/or stoplight) risk assessment of the network.
2.5	The system shall provide a capability to adjust computational weights and measures used to compute risk.
2.9	The system shall provide a capability to assess vulnerabilities by performing service banner testing.
2.1	The system shall provide a capability to assess policy banners (textual context) for compliance with stated policies
2.12	The system shall be fault-tolerant of network and target latency issues.
2.13	The system shall have the capability to provide the status to the operator and a way to degrade and end the scan gracefully if it must be aborted.
2.14	The system shall provide a capability to abort a scan and successfully restart a new scan within the user interface with the resumption of the assessment at or near the point of failure without loss of previously obtained scan results.
2.17	The system shall enable administrators to schedule partial and full scans on protected/managed computing platforms. It shall support scheduling partial scans of specific files, folders, systems, and/or asset groups - as well as full scans of designated assets/asset groups
2.18	The system shall scan target objects with and without any privileged access.
2.2	The system shall perform benchmarking such that one scan can be used as a baseline to compare against the assessment results of other scans.
2.21	The system shall have clearly defined subsets of vulnerability checks based on target type, OS type, or other definable fact.
2.22	The system shall accept input based on industry-standard formats that can be used as seed information for scans. (eg., output from an NMAP scan shall be importable into the tools and the object scanned.
2.23	The system shall provide the capability to pause/resume scans.
3	Application Vulnerability Scanning Requirements (Web, Database, etc.)
3.2	The system shall provide a capability to assess databases (e.g. MySQL, MS SQL, Oracle, etc.).
3.3	The system shall provide a capability to perform Layer 7 security testing (application level testing)
4	Configuration Assessment Requirements
4.4	The system shall provide a capability to assess compliance IAW FISMA standards
4.7	The system shall provide a capability to assess compliance IAW DoD STIG standards
4.1	The system shall provide a capability to assess authentication controls.
4.11	The system shall provide a capability to assess access controls.
4.14	The system shall provide a capability to assess anti-spyware, anti-malware, or anti-virus product configurations on scan targets.
4.16	The system shall provide a capability to perform web-site assessments to include:
4.16.1	Input Validation
4.16.2	Access Control
4.16.3	Session/Account Management
4.16.4	Cross-site Scripting (XSS)
4.16.5	Buffer Overflows
4.16.6	Database Command Injection
4.16.7	Error Handling
4.16.8	Use of Cryptography
4.16.9	Remote Administration
4.16.10	Server Configuration
4.16.11	508 Compliance
4.16.12	PKI Login Support
4.17	The system shall provide the ability to scan common network infrastructure operating systems to include:
4.18	The system shall provide a capability to provide assessments against Windows 32 bit (Windows XP, Windows 7, Windows 8.1, Windows 10, etc.) operating systems for the following:
4.18.1	hardware configuration
4.18.2	software configuration
4.18.3	firmware configuration
4.18.4	user policies
4.18.5	file permissions
4.18.6	registry permissions
4.18.7	service permissions
4.18.8	services running
4.18.9	specific security policies such as Kerberos
4.18.10	processes running
4.18.11	file content checks
4.18.12	password policy auditor
4.19	The system shall provide a capability to provide assessments against Windows 64 bit (Windows 7, Windows 8.1, Windows 10, Windows 11, etc.) operating systems for the following:
4.19.1	hardware configuration
4.19.2	software configuration
4.19.3	firmware configuration
4.19.4	user policies
4.19.5	file permissions
4.19.6	registry permissions
4.19.7	service permissions
4.19.8	services running
4.19.9	specific security policies such as Kerberos
4.19.10	processes running
4.19.11	file content checks
4.19.12	password policy auditor
4.2	The system shall provide a capability to provide assessments against UNIX (e.g. HP-UX, Solaris, etc.) operating systems for the following:
4.20.1	hardware configuration
4.20.2	software configuration
4.20.3	firmware configuration
4.20.4	user policies
4.20.5	file permissions
4.20.6	registry permissions
4.20.7	service permissions
4.20.8	services running
4.20.9	specific security policies such as Kerberos
4.20.10	processes running
4.20.11	file content checks
4.20.12	password policy auditor
4.21	The system shall provide a capability to provide assessments against Linux (e.g. Ubuntu, RHEL, CentOS, etc.) operating systems for the following:
4.21.1	hardware configuration
4.21.2	software configuration
4.21.3	firmware configuration
4.21.4	user policies
4.21.5	file permissions
4.21.6	registry permissions
4.21.7	service permissions
4.21.8	services running
4.21.9	specific security policies such as Kerberos
4.21.10	processes running
4.21.11	file content checks
4.21.12	password policy auditor
4.22	The system shall provide a capability to provide assessments against Apple (e.g. MacOS, iOS, etc.) operating systems for the following:
4.22.1	hardware configuration
4.22.2	software configuration
4.22.3	firmware configuration
4.22.4	user policies
4.22.5	file permissions
4.22.6	registry permissions
4.22.7	service permissions
4.22.8	services running
4.22.9	specific security policies such as Kerberos
4.22.10	processes running
4.22.11	file content checks
4.22.12	password policy auditor
4.23	The system shall provide a capability to provide assessments against thin-client operating systems for the following:
4.23.1	hardware configuration
4.23.2	software configuration
4.23.3	firmware configuration
4.23.4	user policies
4.23.5	file permissions
4.23.6	registry permissions
4.23.7	service permissions
4.23.8	services running
4.23.9	specific security policies such as Kerberos
4.23.10	processes running
4.23.11	file content checks
4.23.12	password policy auditor
5	Remote and Peripheral Device Configuration (Non-Agent Based)
5.1	The system shall provide a non-agent based capability to assess:
5.1.1	Network printer systems.
5.1.2	Multi-functioning device (MFD) systems.
5.1.3	USB connected devices on connected systems.
5.1.4	Firewall configurations.
5.1.5	Router configurations.
5.1.6	Virtual private networking servers and connected clients.
5.1.7	E-mail server configurations.
5.1.8	Remote access service (RAS) servers and clients.
5.1.9	DMZ servers and security.
5.1.10	Wireless security, wireless access points and clients, and wireless configuration settings.
5.1.11	Voice Over Internet Protocol (VOIP) servers, clients, or applications.
6	Graphical User Interface (GUI)
6.1	The system shall provide a graphical user interface for unified execution and management of assessments and reporting.
6.2	The system shall provide a capability to display reports through a graphical user interface.
6.3	The console interface shall be intuitive or easy to navigate and use.
6.4	The system shall provide interactive help functionality through the graphical user interface.
6.5	The system shall provide the ability to see detailed descriptions for every vulnerability checked or identified.
6.6	The system shall provide a capability to easily expand (drill down) on identified vulnerability definitions and explanations.
6.7	The system shall support SSL TLS 1.2 security web access capability or higher.
6.12	The system shall provide a capability to automatically group or break out identified systems by identified type such as; routers/switches, printers or other devices during initial scanning.
6.13	The system shall provide a capability to easily move identified devices to create new groups when necessary or reassign individual or groups of identified systems
6.14	The system shall assess and display the severity of the detected vulnerabilities customizable by the user.
6.15	The system shall provide a flexible, capability to create, maintain and execute assessments based on user-defined or operator-created groups which can be stored and modified.
6.16	The system shall support command-line control over the assessment process.
6.19	The system shall provide a capability to create, edit, archive and delete named vulnerability profiles. It shall enable administrators to name each profile, identify a particular asset/asset group it applies to, and list or link to all standard and custom vulnerability signatures that are applicable to that asset/asset group. It shall permit them to define permanent profiles and ad-hoc profiles
7	Report Generation and Data Export
7.1	The system shall provide a capability to natively display a generated logical network map.
7.3	The system shall provide a capability to provide a detailed network map illustrating what systems, devices, servers and services have been added, removed or changed since the last scan.
7.6	The system shall export scan results on a per-device basis using a defined schema that is provided to the government
7.9	The system shall provide a capability to build selectable report criteria to meet regulatory reporting requirements of the required assessment standards.
7.1	The system shall provide a capability to provide differential reporting capabilities based on an assessed host or group of hosts
7.11	The system shall provide a capability to provide differential reporting capabilities based on an assessed scalable group of hosts.
7.12	The system shall provide a capability to provide differential reporting capabilities based upon non-assessed or non-reachable hosts.
7.13	The system shall provide a capability to provide status changes in the assessed vulnerabilities of all assessed devices to establish and support trending analysis.
7.15	The system shall provide a capability to create ad hoc reports based on the products' stored information including as a minimum the operating system, service pack level, IAVM status, account names and account privileges.
7.16	The system shall provide a capability to create reports that show the check used to identify a vulnerability or other assessed value; e.g. registry setting, service running, OVAL definition, proprietary definition, etc
7.18	The system shall provide a capability to support administrative input to cross reference commercially identified or categorized assessment results (vulnerabilities) to the DoD CPCON reporting compliance requirements.
7.19	The system shall provide a capability to normalize data by re-using common elements, findings and data.
7.2	The system shall provide a capability to provide customizable technical-level summary reports.
7.21	The system shall provide a capability to provide executive-level summary reports.
7.22	All reporting generation and data exportations shall be accomplished within the User Interface (UI).
7.23	The system's presentation interface shall provide a high-level vulnerability view, hierarchically arranged to permit the operator to drill down to specific vulnerability details
7.24	The system's presentation interface shall provide a high-level compliance reporting view, hierarchically arranged to permit the operator to drill down to specific compliance details.
7.25	The system shall provide a capability to group vulnerability data into analytically meaningful categories such as: vulnerability and vulnerability type detected, threat level, risk level, vulnerability count, Alphabetically / Lexically, and Severity/Priority identified within categories such as critical, important, moderate, and low.
8	Help Features
8.1	The system shall provide adequate information or help capabilities embedded within the tool to provide additional information concerning the capabilities either through help pages, right-click functionality or mouse-over content displays.
8.2	The system shall provide the SA with step-by-step instructions appropriate for the platform to facilitate ease of installation and configuration operations.
8.3	The system shall provide possible remediation techniques.
8.4	The system shall provide clear and concise update notes outlining all changes to the product and scanning and signature updates.
9	Non-Disruptive to Normal Operations
9.1	The system shall provide minimum interference with user(s) day-to-day productivity, usability and functionality.
10	SCAP Compliance
10.1	The system shall export assessment and vulnerability data IAW SCAP standards in each of the following formats where appropriate:
10.1.5	Open Vulnerability and Assessment Language (OVAL)
10.1.6	Common Vulnerability Scoring System (CVSS)
10.1.7	Assessment Results Format (ARF)
10.1.8	Open Checklist Interactive Language (OCIL)
10.1.9	Advanced Systems Reporter (ASR)
10.2	The system shall import assessment and vulnerability data IAW SCAP standards in one or more of the following formats:
10.2.1	Common Vulnerabilities and Exposures (CVE)
10.2.2	Common Configuration Enumeration (CCE)
10.2.3	Common Platform Enumeration (CPE)
10.2.6	Common Vulnerability Scoring System (CVSS)
10.2.7	Assessment Results Format (ARF)
10.2.8	Application Programming Interfaces (API)
10.2.9	JavaScript Object Notation (JSON)
10.3	The system shall provide the ability to download XCCDF and OVAL checks from the National Institute of Standards and Technology National Vulnerability Database.
11	Access Control
11.1	The system shall enforce role-based access controls supported through the DoD CAC PKI for administrators, auditors, remote access, or risk managers to the system.
11.2	The system (including any of its agents) shall guide and coordinate multiple administrators and authorized users through common tasks or default processes and allow only those with proper authority to perform each task/job/transaction.
11.3	The system shall have the capability to allow administrators to create, add, modify, or delete new threat/event correlation rule sets. Administrators may not delete predefined rule sets or rule sets developed by other administrators.
12	Logging/Alerting
12.1	The system shall support external help-desk trouble ticketing applications for problem resolution and escalation.
12.2	The system shall support external integration with SIEM vendors. This shall be done directly through the product and/or through open standards & protocols.
12.5	The system shall permit the administrator to define the time period to retain the scan results and support removal and archiving.
12.8	System log access shall be limited to a security manager account.
13	Centralized Management
13.1	The system shall store the results from assessments in a centralized repository or be able to access decentralized storage, if used, seamlessly.
13.2	The system shall operate in an MS Active Directory Domain.
13.5	The system shall protect the confidentiality and integrity of all stored data.
13.8	The system shall support scan auditing and validation such as timestamp, scan lapse time, scan policy attributes, and non-repudiation.
13.9	The system shall support enterprise deployments from an organization's top-level architecture to individualized deployments in smaller enclaves that may be protected by firewalls and other security devices that are part of the DoD defense-in-depth posture.
13.1	The system shall have a low false positive rate of assessed systems and vulnerabilities (inaccurate finding of a vulnerable system).
13.11	The system shall have a low false negative rate of assessed systems and vulnerabilities (failure to identify an actual vulnerability).
13.13	The system shall manage and correlate vulnerabilities discovered by 3rd party scanners.
	Non-Traditional IT Assessment
14	The systems shall provide the ability to assess IT functionality that exists at different levels of abstraction than physical or virtual devices. This functionality shall include, but not limited to: containers, clouds, Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS)
14.1	SaaS capabilities
14.2	PaaS capabilities
14.3	IaaS capabilities
14.4	Container capabilities
14.5	The system shall have the capability to passively and/or actively query an operational technology (OT) environment to retrieve information. OT environments include but aren’t limited to: Industrial Control Systems, Programmable Logic Controllers, Distributed Control Systems, Supervisory Control and Data Acquisition Systems, Building Management Systems, Fire Control Systems, Remote Terminal Units, Human Machine Interfaces.
14.6	The system shall have the capability to passively and/or actively enumerate Internet of Things (IoT) devices. Examples of IoT devices include but aren't limited to: VOIP Telephones, Smart Printers, Smart TVs, Smart UPS Systems, RFID / Barcode Scanning Systems, etc.

Sheet1

Blank

Currently Meets

Does Not Meet

Planned Future Capability

File details come from the government source that posted it. Updated Apr 10, 2025.