Appendix B_EDR_EPP Reqs March 4 2025.xlsx

XLSX spreadsheet 85 KB Posted Mar 6, 2025

Attached to: DF01--VA Server Enterprise Endpoint Security (VASEES)-New Award (VA-25-00011736)
Solicitation number: 36C10B25Q0203
Issued by: Department of Veterans Affairs Technology Acquisition Center Austin

About this file

Written by GovTribe AI · Mar 6, 2025

This file is a requirements specification document titled "Appendix B_EDR_EPP Reqs March 4 2025" that outlines detailed technical requirements for an enterprise endpoint security solution for the Department of Veterans Affairs. The document contains seven major requirement categories: General Requirements, EPP Operational Requirements, Cyber Hunt & Threat Analysis Requirements, Incident Response Requirements, Endpoint Forensics Requirements, Heuristic Behavior Analytics Requirements, and Application Control Requirements.

The specifications call for a comprehensive endpoint protection platform (EPP) solution that must support at least 200,000 devices initially with ability to scale to 600,000+ endpoints across multiple operating systems including Windows, Linux, Unix variants, and cloud environments. Key capabilities required include endpoint detection and response (EDR), application control, device control, forensics capabilities, threat hunting, incident response, and behavioral analytics. The solution must meet FIPS 140-2 compliance, FedRAMP High certification, and integrate with existing VA systems like ServiceNow, Active Directory, and SIEM tools. Notable technical requirements include support for air-gapped networks, medical devices without internet connectivity, ransomware protection, crypto mining detection, and the ability to maintain endpoint protection when devices are off-network.

View the file

Other files

File	Type	Posted
36C10B25Q0203 0001.docx	DOCX document	Jul 29, 2025
RFI Questions and Answers 3172025.pdf	PDF	Mar 17, 2025
Appendix B_EDR_EPP Reqs March 4 2025.xlsx	XLSX spreadsheet	Mar 6, 2025
RFI QUESTIONS 36C10B25Q0203.pdf	PDF	Mar 6, 2025
PWS VASEES RFI.pdf	PDF	Mar 6, 2025
36C10B25Q0203.docx	DOCX document	Mar 6, 2025
Appendix A - VASEES SERVICE LEVEL AGREEMENTS RFI.pdf	PDF	Mar 6, 2025

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

Sheet1

Endpoint (EPP) Solution Requirements

Spec#

Description

Solution Capability

OS Type

Detailed Response

.00.

General requirements (common requirements for most CSOC tools / technologies / vendor products)

Windows Server 2003

Windows Server 2008

Windows Server 2008 R2

Windows Server 2012

Windows Server 2012 R2

Windows Server 2016

Windows Server 2019

Windows Server 2022

CentOS Linux

IBM Unix

Linux

Red Hat Linux 4.0-6.x

Red Hat Linux 7.x

Red Hat Linux 8.x

Red Hat Linux 9.x

SUN Unix

Solaris

SUSE Linux 11 & 12

SUSE Linux 15

Ubuntu Linux

VMWare Photon

Other

tc={E1142C26-8E38-4B04-BEB4-5CB50CEE88E5}: [Threaded comment]

Your version of Excel allows you to read this threaded comment; however, any edits to it will get removed if the file is opened in a newer version of Excel. Learn more: https://go.microsoft.com/fwlink/?linkid=870924

Comment:

The PWS 3.0 and 5.5.4.1 mentions Macintosh servers, but no Mac server OS type listed here. Please provide a response outlining gaps or deltas comparing all checked applicable OS versions that clearly describe how this requirement is met based on the solution used for the response and which vendor technology is used if the solution includes multiple.

tc={4B3A531F-CDF1-464A-BFFE-4F0B19576E6E}: [Threaded comment]

Comment:

Add to questions in the RFI?

GEN.00.01	Solution must have demonstrated the ability to provide a full enterprise host endpoint monitoring solution scalable at 200,000 devices or above and OS types as defined
GEN.00.02	All communication between agents and console are encrypted
GEN.00.03	Utilizes FIPS 140-2 compliant encryption for data-in-motion and data-at-rest
GEN.00.04	Multiple OS support, full native manageability within the console to include all current and planned OS deployments in the VA; must be able to support new OS's and Versions within 6 months of release/deployment at the VA
GEN.00.05	Modular system enabling the VA to update components and extend COTS functionality
GEN.00.06	Different levels of network throttling are available to control host system impact and bandwidth utilization
GEN.00.07	System admins can schedule endpoint scans and analyze jobs from console that execute on specified hosts
GEN.00.08	Agents, updates, and patches are deployable with standardized deployment methods, systems, and tools
GEN.00.09	Logging levels can be calibrated to control the types and volume of logged events on the agent and console but are able to meet all M-21-31 requirements
GEN.00.10	Agents can be persistent or deployed to hosts of interest on demand
GEN.00.11	Enables multiple analysts to connect to the system and run jobs concurrently
GEN.00.12	Utilizes a web-based user interface to the console. If more than one web based interface is needed to manage endpoints i.e. policy assignment, task assignments, product updates, endpoint health, and creating and running actionable reports. List those interfaces and which items from the list can be managed from each of the respective web interface.

tc={18ECF7BB-790D-4C5D-BEF6-2EAB510E844D}: [Threaded comment]

Comment:

"List those interfaces…" do we need to point this out in the RFI questions ?

GEN.00.13	Supports a simple to use query language that allows queries to be easily constructed against all available data sources
GEN.00.14	Create and run summary and detailed reports, as a scheduled job or manually on demand using either canned or user-customized options.
GEN.00.15	Reports can be created via a GUI report wizard without the requirement to use scripting or query languages for report creation and generation.
GEN.00.16	Reports can be created by generating custom queries against the threat database
GEN.00.17	Allows the export of reports in multiple formats (DOC, DOCX, PDF, XML, CSV at a minimum) via email, download, or posting to a share. The capability must be native to the relevant product console.
GEN.00.18	Threat alerts are delivered to the centralized console and security team users notified
GEN.00.19	Single central database console for actively querying for files (names, type, hash, or other) with role-based access capabilities
GEN.00.20	Event data and scan results across concurrently running agents are collected within a centralized, queryable database
GEN.00.21	Near real-time enterprise visibility (1 hour or less from the relevant console) across the entire network infrastructure including endpoints, servers, cloud, systems, and applications to include off-network clients.
GEN.00.22	Real-time analysis of collected event data and alerts from all security devices
GEN.00.23	Minimal host and enterprise resource impact from endpoint agent (example, network utilization, processing, memory,etc)
GEN.00.24	Support medical device endpoints without internet or cloud connectivity.
GEN.00.25	API-driven integration with other security tools
GEN.00.26	Ability to automatically ingest data, such as IOC feeds in a common format
GEN.00.27	Ability to automatically export data in a standard format
GEN.00.28	Ability to allow query of data via APIs
GEN.00.29	Ability to integrate with visualization tools
GEN.00.30	Ability to integrate with Splunk and other SIEM for searching and correlation of all endpoint data
GEN.00.31	Must support all enterprise managed OS versions and device types
GEN.00.31	Must support on-premise and cloud hosted systems/devices
GEN.00.32	Must maintain the ability to communicate, query, and manage clients not connected to the enterprise network
GEN.00.33	Must be able to integrate with and manage devices therein large cloud service providers contracted with VA for cloud hosting (Azure, AWS, etc)
GEN.00.34	Must integrate with industry accepted security orchestration, automation and response (SOAR) products/vendors
GEN.00.35	Must be able to integrate with ServiceNow and other industry standard ticketing systems
GEN.00.36	Performance benchmarking via public communities (such as Virus Total), 3rd party testing services (such as NSS labs, others)
GEN.00.37	Compatibility with existing / planned endpoint agents such as DLP, NGAV, HBA
GEN.00.38	Ability to scale / perform at very large deployments ( 600,000 + endpoints)
GEN.00.39	Ability to work within a federated / distributed network while providing a common admin interface
GEN.00.40	Ability to fully function within air-gapped networks / devices
GEN.00.41	Zero / low false positive rate
GEN.00.42	RBAC to set and manage different administrative access levels for users
GEN.00.43	Integrate with Microsoft Active Directory for authentication
GEN.00.44	Centralized, role-centric console or dashboard to enable the real-time visibility of VA's endpoint security state
GEN.00.45	Provides clearly prioritized alerts and warnings
GEN.00.46	Provides intuitive administration workflows
GEN.00.47	If SaaS or cloud-hosted, shall provide security documentation with FEPPAMP templates within 90 days of contract award
GEN.00.48	If SaaS or cloud-hosted, shall provide 3PAO assessment of the cloud service within 180 days after completing FEPPAMP security documentation
GEN.00.49	If SaaS or cloud-hosted, shall respond to and remediate high severity risks documented in 3PAO assessment within 60 days
GEN.00.50	Solution MUST be FEPPAMP certified if a cloud component is part of the solution; certification MUST NOT be reliant on VA sponsorship
GEN.00.51	Solution must be to meet or certified 508 compliance
GEN.00.52	Solution must adhere to NIST and OMB federal requirements
GEN.00.53	Solution must be able to utilize varying levels of storage retention (active, warm storage, cold storage retention)
GEN.00.54	Solution must be able to adhere to MFA agency requirements for all access levels
GEN.00.55	Solution must be able to assign role-based account to include but not be limited to: reviewer, analyst, site/group admin, multiple site/group admin, and full administrator
GEN.00.56	Solution must maintain a complete audit log of all actions by each user within the management console.
GEN.00.57	Solution must be able to utilize certificate and PIV or equivalent based validation for access
GEN.00.58	Solution must offer a single point of administration across the entire solution set and all modules therein
GEN.00.59	Solution must provide industry standard level anti-virus and malware protection for all managed endpoint devices
GEN.00.60	Solution must provide industry standard level host-based firewall capabilities for all managed endpoint devices
GEN.00.61	Solution must provide industry standard level application containment based on a risk score automatically utilizing available threat heuristic behavior analysis of activities for all managed endpoint devices
GEN.00.62	Solution must provide external or peripheral device management (device control) for all managed endpoint devices
GEN.00.63	Solution must provide industry standard level application control whitelisting capabilities for all managed endpoint devices
GEN.00.64	Solution must provide industry standard level web traffic analysis and blocking capabilities for all managed endpoint devices
GEN.00.65	Solution must provide industry standard level threat intelligence sharing amongst all manage devices
GEN.00.66	Solution must maintain a high degree of 3rd party integration with other cybersecurity tools
GEN.00.67	Solution must be able to identify non-managed clients on network segments and/or cloud classless inter-domain routings (CIDRs)
GEN.00.68	Solution must provide industry standard level endpoint detection and response (EDR) and/or extended detection and response (XDR) capabilities for all managed endpoint devices

.01.	EPP Operational Requirements
EPP.01.01	Risk management - determine scope of compromise
EPP.01.02	Full asset inventory and profile reporting over a 24 hour, 1 week, 1 month, quarter, semi-annual, and yearly basis at minimum
EPP.01.03	Automatic scanning of unknown files and performing file integrity checks
EPP.01.04	Gather forensic data including but not limited to memory, volatile data, files, process data, and files on disk
EPP.01.05	Continuous packet capture
EPP.01.06	Contain and fix malicious files by quarantine and removal
EPP.01.07	Blacklisting for malicious files, hashes, wildcard values, and file types.
EPP.01.08	Continuous file whitelisting
EPP.01.09	Application, folder, and file level whitelisting
EPP.01.10	Identify and report capabilities and behaviors of binaries and processes to the analyst
EPP.01.11	Can perform static, on-demand malware detection scans of folders, drives or devices such as USB drives and network share locations
EPP.01.12	Suspicious event data can be stored in a centralized location, for retrospective IOC/IOA searching and analysis
EPP.01.13	Allows real-time IOC/IOA searching across all endpoints
EPP.01.14	Allows remote quarantining or network resource isolation of an endpoint, restricting network access to only the EPP management server and/or other forensic applications
EPP.01.15	Automatically update policies, controls, security postures, definition files, and new agent/engine versions without connecting directly to the VA network
EPP.01.16	Continues to collect event data when device is outside of the VA network
EPP.01.17	Ability to update indicators of attack or compromise from threat intelligence sources other than the proprietary signatures and indicators from the vendor (API, STIX/TAXII or other standard indicator sharing connection)
EPP.01.18	Ability to detect file-based malware
EPP.01.19	Ability to detect fileless or memory-based malware
EPP.01.20	Ability to detect malware based on signatures
EPP.01.21	Ability to detect malware based on heuristics
EPP.01.22	Ability to detect malware based on behavior analytics
EPP.01.23	Ability to use and provide reputation scoring data for all endpoint protection actions
EPP.01.24	Ability to detect malware based on threat intelligence data
EPP.01.25	Alerting on intrusion attempts and must allow for custom signature creation and IOC ingestion
EPP.01.26	Detections and alerts include severity and confidence indicators to aid in prioritization
EPP.01.27	Detects suspicious and malicious activity based on the behavior of a process
EPP.01.28	Ability to detect lateral movement in APTs on the network. Detect workstation to workstation communications. Detect communication attempts to Domain Controllers or other HVAs that require "jump box" or controlled access from specific administrator machines/servers.
EPP.01.29	Must not impair authorized system operations (e.g., patching, scanning, business software usage, information assurance tools/initiatives, secure host baseline, assured compliance assessment solution, etc.) nor shall it degrade managed system performance in any way, which may adversely impact a system's primary business functions.
EPP.01.30	Software updates are pushed to the server over the network and the agents can be updated without reboot. Additionally Patches, Updates, Engines, Agents and Version must be capable of being evaluated, tested, and pass a configuration review prior to role out .
EPP.01.31	Product should provide Devices Control management for all managed endpoints
EPP.01.32	Product should provide Device Control policy that is granular enough to allow specific user and device ID customization across managed endpoint devices
EPP.01.33	Device Control should include a monitor/ learning capability
EPP.01.34	Device Control exclusion creation should be done via a GUI interface in the console.
EPP.01.35	Product must provide removable media encryption when media creation is authorized.
EPP.01.36	Printers should be managed as a device class and not individual devices.
EPP.01.37	Product will provide out of the box reporting for Device Control event reporting.
EPP.01.38	Regardless of Operating System, all managed endpoint devices should be managed from a single console, including all functionality and/or modules.
EPP.01.39	All aspects of client management should be managed from one web based console i.e. policy assignment, task assignments, product updates, endpoint health, creating and running actionable reports
EPP.01.40	Support centralized, role-centric console or dashboard to enable the real-time visibility of VA's endpoint security state
EPP.01.41	Support Real Time Enterprise Visibility across the entire network infrastructure including endpoints, servers, cloud, systems, and applications
EPP.01.42	Event and client health reporting with actionable information should be available in the product management console.
EPP.01.43	Product will have the ability to create and run summary and detailed reports, whether manually or automated, using canned or user-customized options
EPP.01.44	Allows the export of reports in multiple formats (PDF, XML, CSV) to be downloaded, stored within a document store (SharePoint, file server, etc), or emailed. Capability must be native to relevant product console
EPP.01.45	Product should allow for use of wild cards in creation of scanning exclusion for drive, file or path.
EPP.01.46	Systems with restricted ACLs (MDI or SPDIA) require ability to receive updates with no internet or cloud connectivity.
EPP.01.47	Ransomware Rollback capability is required on all protected clients.
EPP.01.48	System admins can schedule endpoint scans and analyze jobs from console that execute on specified hosts
EPP.01.49	Reports must be easily generated via a GUI report wizard, or other native tool within the solution
EPP.01.50	Device encryption capabilities must be natively available for removable media based on policy assigned to a user, group, device, or other unique identifiers
EPP.01.51	Output able to be emailed, saved locally, or saved on a shared location and/or service must be able to be encrypted
EPP.01.52	the solution shall have ability to share suspicious or heuristic behavior files/sites/executions with other managed clients to prevent further spread or infection
EPP.01.53	The solution shall have the ability to block domains and/or category groupings of activity from client browsers via policies
EPP.01.54	The solution shall maintain temper protection on all supported Osse which prevents the disabling, removing, or modifying of system behavior outside of policy constraints

.02.	EPP Protection capabilities
EPP.02.01	Ability to apply process isolation
EPP.02.02	Ability to apply memory protection
EPP.02.03	Ability to apply exploit prevention
EPP.02.04	Ability to apply sandbox detonation
EPP.02.05	Ability to apply cloud detonation
EPP.02.06	Ability to apply hash lookups
EPP.02.07	Ability to apply application whitelisting
EPP.02.08	Ability to apply TTP based protection
EPP.02.09	Ability to apply integrated patch management
EPP.02.10	Incident prevention and investigation capabilities, with guided response tools
EPP.02.11	Incident prevention and investigation capabilities with discovery, reporting, and prioritization of vulnerabilities
EPP.02.12	Active response capabilities such as killing processes, blocking network connections, and quarantining and removing files automatically
EPP.02.13	Malware detection accuracy performance benchmarking via public communities (such as Virus Total)
EPP.02.14	Malware detection performance benchmarking via 3rd party testing services (such as NSS labs, others)
EPP.02.15	Ability to block malware when offline / disconnected from network
EPP.02.16	Blocks known and unknown file-based malware, without relying on daily signature distribution
EPP.02.17	Implements protection for common application vulnerabilities and memory exploit techniques
EPP.02.18	Automatically quarantines malicious files
EPP.02.19	Identifies changes made by malware and provides the recommended remediation steps
EPP.02.20	Detects, blocks, and reports attempts to disable or remove the EPP agent
EPP.02.21	Implements vulnerability shielding (aka virtual patching) for known vulnerabilities in the OS and for non-OS applications
EPP.02.22	Can implement default-deny whitelisting with a vendor maintained "app store"-type approach, and user self-service features
EPP.02.23	Can implement application isolation, to separate untrusted applications from the rest of the system
EPP.02.24	Includes access to a cloud or network-based sandbox that is VM-aware
EPP.02.25	Includes deception detection capabilities designed to expose an attacker
EPP.02.26	Includes a Host Based FW that can manage all VA Endpoints regardless of Operating System.
EPP.02.27	Host based FW should have the capability to operate in a listening or adaptive mode that identifies traffic that would have been blocked in an active mode.
EPP.02.28	Product should have the ability to apply customer defined threat reputation for VA developed applications with no signed certificate
EPP.02.29	Product must have a host firewall solution that allows management of all VA endpoints (see GEN.00. DT/LT, GEN. 00.SRVR and GEN.00.CLD
EPP.02.30	Product host firewall must deny by policy allow by exception.
EPP.02.31	Product should provide capability for real time and scheduled threat scans of Network Area Storage.
EPP.02.32	Solution should have the ability to track changes with a change management mindset/approach natively (example: connection to ServiceNow or other ticketing system, or track changes within an audit log that can be notated with change control information)

.03.	Cyber Hunt & Threat Analysis Requirements
CHTA.03.01	Basic endpoint metadata: Internet Protocol (IP) address, Media Access Control (MAC) address, DNS names
CHTA.03.02	Basic endpoint metadata: hardware data
CHTA.03.03	Basic endpoint metadata: plugged USB devices
CHTA.03.04	Network data: endpoint DNS, ARP and routing tables, and other live network data
CHTA.03.05	Network data: open ports and related processes
CHTA.03.06	Network data: network connections to/from the endpoint
CHTA.03.07	Network data: URLs browsed from the endpoint
CHTA.03.08	Execution data: running processes, threads, and their metadata
CHTA.03.09	Execution data: Windows services
CHTA.03.10	Execution data: user logon and logoff activity
CHTA.03.11	Execution data: inter-process communications (IPC) channel
CHTA.03.12	Execution data: process actions such as data reads/writes
CHTA.03.13	Stored data: file metadata (such as name, size, type, and cryptographic hash sums)
CHTA.03.14	Stored data: files (usually specific files or those that executed)
CHTA.03.15	Stored data: changes to files
CHTA.03.16	Stored data: select Windows registry settings
CHTA.03.17	Stored data: observed Windows registry changes
CHTA.03.18	Stored data: endpoint logs such as Windows event logs or Linux syslog
CHTA.03.19	Stored data: master boot record (MBR) information
CHTA.03.20	Stored data: loaded DLLs
CHTA.03.21	Stored data: active device drivers and loaded kernel modules
CHTA.03.22	Stored data: browser extension and history
CHTA.03.23	Stored data: CMD and PowerShell command history
CHTA.03.24	Memory contents
CHTA.03.25	Server-side detection: rare and new processes
CHTA.03.26	Server-side detection: deviations from collected baselines
CHTA.03.27	Server-side detection: comparisons with endpoint behavior models built over time across the entire environment
CHTA.03.28	Server-side detection: historical data matching with recently obtained IOCs
CHTA.03.29	Cloud-side detection: deviation from baselines across organizations
CHTA.03.30	Cloud-side detection: whitelisting, blacklisting, and other reputation list checks for files, URLs, domains, etc.
CHTA.03.31	Data presentation/visualization: pivoting/correlation
CHTA.03.32	Data presentation/visualization: kill chain mapping
CHTA.03.33	File hash querying and identification
CHTA.03.34	Registry monitoring in all hives
CHTA.03.35	Port usage monitoring
CHTA.03.36	Process tracking (with parameters)
CHTA.03.37	Machine profiling (based on OS, use, etc.)
CHTA.03.38	Over the wire capability (basic infection information)
CHTA.03.39	Sweep or hunt capability
CHTA.03.40	File forwarding for additional analysis
CHTA.03.41	Automated identification & isolation of suspected malicious files or signatures
CHTA.03.42	File structure monitoring
CHTA.03.43	File retention of flagged
CHTA.03.44	Cache inspection of incident event (historical tracking)
CHTA.03.45	Automated triage
CHTA.03.46	Quarantine of infected devices
CHTA.03.47	Whitelisting of forensic processing during quarantine processing
CHTA.03.48	Scriptable acquisitions
CHTA.03.49	File object acquisitions
CHTA.03.50	Ability to detect and block memory attacks such as process injection, buffer overflows, and privilege escalation

.04.	Incident Response Requirements
IRP.04.01	Ability to detect local account creation
IRP.04.02	Ability to manage agents off the network
IRP.04.03	Ability to query file and process hashes across enterprise
IRP.04.04	Ability to isolate infected system, but retain ability to gather artifacts and ensure no artifacts are left behind following removal
IRP.04.05	Ability to replay attack chain
IRP.04.06	Ability to automate responses and workflows
IRP.04.07	Ability to create custom signatures
IRP.04.08	Ability to integrate external threat data feeds in response
IRP.04.09	Ability to integrate with ServiceNow and Remedy ticketing solution
IRP.04.10	Ability to safely capture and transport malicious artifacts
IRP.04.11	Ability to configure sandboxing of known malicious vectors
IRP.04.12	Ability to support safe web browsing
IRP.04.13	Ability to alert on registry modifications
IRP.04.14	Ability to detect and alert on lateral movement
IRP.04.15	Ability to detect suspicious shellcode processes
IRP.04.16	Ability to detect ransomware via encryption of large quantities of files in a short period of time or any attempts to encrypt MBR or root files while the system is operational
IRP.04.17	Ability to detect and mitigate crypto mining malware
IRP.04.18	Remotely remediate infected hosts on the network to a pre-infection state
IRP.04.19	Ability to ingest IOCs that can be used to scan hosts for known breach indicators

.05.	Endpoint Forensics Requirements
FORN.05.01	The solution must support remote live read-only investigation(s) and artifact recovery with no file level locking
FORN.05.02	The solution must support remote forensic preview of hard disks and copying of files and artifacts from suspect machines in a forensically sound manner
FORN.05.03	The solution must enable remote imaging of physical RAM in a forensically sound fashion
FORN.05.04	The solution must enable physical and logical disk acquisitions in a forensically sound fashion
FORN.05.05	The solution must provide connectivity to VAEC cloud providers to enable acquisition and analysis of data in the cloud
FORN.05.06	The solution must be vendor neutral and able to integrate with any VA forensic analysis tool
FORN.05.07	The solution must be deployable through standard application deployment methods such as SCCM and BigFix
FORN.05.08	The solution must be scalable to support a large enterprise network. Installs on unlimited number of endpoints and provides multiple simultaneous connections.
FORN.05.09	The solution must be deployable to the vast majority of OS platforms used in the VA. This includes Windows (32 & 64 bit), OS X, Linux, Solaris, AIX, and HPUX
FORN.05.10	The solution must facilitate forensically sound, authenticated, and secure communication from CSOC to endpoints. Examiner cannot alter files or make any changes to the machine under investigation. All connections are write-protected and industry standard authentication mechanisms are used.
FORN.05.11	The solution must maintain an audit log that records individual analyst activity and connection information
FORN.05.12	The solution must utilize a non-intrusive agent with a small footprint that does not cause any performance impact to the end-user
FORN.05.13	The endpoint agent should require no drivers for installation, install seamlessly without endpoint interruption, as well as not to require a system reboot when deployed or installed
FORN.05.14	The endpoint agent licensing must be unlimited instead of per endpoint
FORN.05.15	Data in transit from the endpoint to the analyst must be encrypted using a validated FIPS 140-2 cryptographic module
FORN.05.16	The solution may remotely remediate infected hosts on the network to a pre-infection state
FORN.05.17	The endpoint agent should be able resume an acquisition in case of network disconnect/failure without restarting
FORN.05.18	The solution must support searches that can be performed against physical memory, binary objects, live OS, and raw disk
FORN.05.19	The solution must support all current and legacy file systems used in the VA. This includes Windows FAT, NTFS, HFS/+, Solaris, ext2/ext3, XFS, etc.
FORN.05.20	The solution must be able to search hosts using a multitude of attributes such as file names, file signatures, hash values, registry keys, event logs, low level file/executable attributes, etc.
FORN.05.21	The solution must allow for easy importing of custom whitelist and blacklist rules for filtering specific threat data
FORN.05.22	The solution must be able to natively decrypt volumes encrypted with BitLocker and other full-disk encryption solutions used in the VA
FORN.05.23	The solution must be able to read and analyze evidence files stored in common formats (i.e., DD raw, E01, EX1, etc)
FORN.05.24	The solution must be compatible with all VA forensic hardware. This includes Tableau write blockers, TX1 duplicator, and other peripherals.
FORN.05.25	The solution must be able to read and image different forms of media such as SATA, IDE, SCSI, SAS, RAID disk sets, etc.
FORN.05.26	The solution must be able to produce an exact duplicate of an original drive or media in a forensically sound manner and then verify it by using hash values such as MD5 or SHA1. It must detect when evidence has been tampered or altered.
FORN.05.27	The solution must be able to produce a logical evidence container of only files and folders specified by the analyst
FORN.05.28	The solution must be able to automatically search for and recover deleted partitions, files, folders, and artifacts from the file system, file slack, and unallocated space
FORN.05.29	The solution must have the ability to write custom scripts or use built-in scripts to automate forensic actions
FORN.05.30	The solution must have robust search and indexing capabilities. It must support string and GREP searches, filters, conditions, raw binary, proximity searches, internet and email artifact search, and keywords in multiple languages.
FORN.05.31	The solution must be capable of generating user-customized reports
FORN.05.32	The solution must have bookmarking capability for all forensic data. Analysts should be able highlight and organize notable files, folders, and artifacts.
FORN.05.33	The solution must support internet and email investigations. It should be capable of parsing browser artifacts, web history, cache, P2P, and HTML across all web browsers. It must be able to analyze email artifacts from all versions of Outlook, O365, webmail, Exchange, and other email software. It must be able to recover deleted data and analyze evidence from the deleted items folder, .pst files, and in unallocated disk space.
FORN.05.34	The solution must have built-in native viewing for all known file types. This includes Adobe files, compressed files, email, MS Office, HTML, image files, text files, etc. It must also support external file viewers, integrated image viewer, built-in registry viewer, and timeline/calendar viewer. For mobile devices, it must be capable of analyzing plist files, SQLite databases, iTunes backups, and other mobile artifacts. It must support non-proprietary, non-encrypted images and file formats from 3rd party vendors.
FORN.05.35	The solution must be compatible with CSOC forensic hardware
FORN.05.36	The solution may use either hardware or software licenses. The license must be perpetual and usable in a remote environment.
FORN.05.37	The solution must support logical and filesystem acquisitions of mobile forensic devices including iOS and Android.
FORN.05.38	The solution should perform automated decryption by utilizing tokens and keychains from mobile devices
FORN.05.39	The solution must be capable of parsing partitioned and non-partitioned virtual machine disk files
FORN.05.40	The solution must support advanced analysis and decoding of extracted mobile application data

.06.	Heuristic Behavior Analytics
HBA.06.01	The solution must support Psycholinguistic Analysis.
HBA.06.02	The solution must have the ability to track key words
HBA.06.03	The solution must have default/pre-packaged use case.
HBA.06.04	The solution must have the flexibility to allow the creation of custom use cases.
HBA.06.05	The solution must have the ability to identify and report on new anomalous traffic and support manual entry of threat risk lists.
HBA.06.06	The solution must detect anomalous activity in near real time.
HBA.06.07	The solution must have the ability to create watch lists for users both automatically for defined criteria and manually.
HBA.06.08	The solution must provide multivariate risk scores for all VA users; risk scores must consider current activity, recent historical activity, comparisons against the individual user’s activity, and comparisons against the users work peer group.
HBA.06.09	The solution must provide combined risk scores of insider risk scenarios computed by behavior models analyzing data from disparate data sources and separate networks.
HBA.06.10	The solution must provide a library of user and network behavior models.
HBA.06.11	The solution must provide automatic timelines for Incident.
HBA.06.12	The solution must be able to ingest and analyze logs from industry standard sources.
HBA.06.13	The solution must comply with The National Insider Threat Task Force (NITTF) requirements for insider threat programs.
HBA.06.14	The solution must support machine learning based and behavioral based threat detection, analysis, and mitigation.
HBA.06.15	The solution must monitor and record all analyst forensic activity performed, enabling verification that investigations are performed in accordance with established policies, e.g. annual audits.
HBA.06.16	The solution must monitor and record all analyst administration activity performed, enabling verification that changes are performed in accordance with established policies, e.g. annual audits.
HBA.06.17	The solution must automatically escalate the monitoring of a user based on event triggers which can be customized; these escalations must at a minimum include but not be limited to keystroke logging and screen video capture.
HBA.06.18	The solution must monitor and collect data when any user is not connected to the network and must have the capability to cache data including keystrokes and video on the endpoint on a per-user per-policy basis to be uploaded at the next network connection.
HBA.06.19	The solution must group and export information into a "case" for the purpose of investigations.
HBA.06.20	The solution must support data filtering to determine the appropriate action based on defined policies.
HBA.06.21	Must provide identity and user visibility in network traffic.
HBA.06.22	Must be capable of incorporating human risk to detect anomalies and outlier indicators.
HBA.06.23	The solution must support ingestion and analysis of unstructured communication data sources.
HBA..06.24	It is expected that the solution shall have the ability to be configured, tune, and be fully operated by Tier II and III analysts; the solution will not require a Data Scientist for optimum operation,

0.07	Application Control
APPC.07.01	The solution shall utilize installable agents for the defined operating systems and future needs within 60 days of enterprise adoption
APPC.07.02	The solution shall be able to report and track system resource utilization along with the ability to scale down or limit said resource utilization
APPC.07.03	The solution shall not utilize more than 10% of the total processor time while a user is logged in.
APPC.07.04	The solution shall not utilize more than 10% of the total available memory while a user is logged in.
APPC.07.05	The solution shall not utilize more than 40% of the total processor time while the user is idle.
APPC.07.06	The solution shall not utilize more than 25% of the total available memory at any time.
APPC.07.07	The solution shall not require a reboot for installation or uninstallation.
APPC.07.08	The solution shall support changing execution enforcement levels without requiring a reboot.
APPC.07.09	The solution shall support installation in a passive mode with no enforcement.
APPC.07.10	The solution shall support scanning of all files on a workstation within 20 minutes.
APPC.07.11	The solution shall support scanning of all files on a server’s primary OS and application volumes within 1 hour.
APPC.07.12	The solution shall support monitoring from the management console the level of completeness of the file scanning of a given system in near real time.
APPC.07.13	The solution shall hash all applicable file types (Example but not limited to: EXE, PS1, JS, BAT, DLL,…)
APPC.07.14	The solution shall track changes to hash values of all applicable file types and corresponding new hash values (Example but not limited to: EXE, PS1, JS, BAT, DLL,…)
APPC.07.15	The solution shall prevent the execution of unauthorized files.
APPC.07.16	The solution shall prevent the execution of malicious files.
APPC.07.17	The solution shall prevent the execution of untrusted files.
APPC.07.18	The solution shall prevent the execution of unwanted files.
APPC.07.19	The solution shall support a Monitor Only enforcement level.
APPC.07.20	The solution shall support a Low enforcement level where the end-user is allowed to self-approve file execution.
APPC.07.21	The solution shall support High enforcement where only administrators of the solution can approve executables through the console.
APPC.07.22	The solution shall support being disabled on specified endpoints.
APPC.07.23	The solution shall support file execution denial by hash
APPC.07.24	The solution shall support file execution denial by trusted updaters/publishers
APPC.07.25	The solution shall support file execution denial by trusted installers.
APPC.07.26	The solution shall support file execution denial by certificates.
APPC.07.27	The solution shall support file execution denial by reputation.
APPC.07.28	The solution shall support file execution denial by trusted directory path.
APPC.07.29	The solution shall support file execution denial by a trusted network path.
APPC.07.30	The solution shall support file execution denial by user identity.
APPC.07.31	The solution shall support file execution denial by parent process identity.
APPC.07.32	The solution shall support file execution denial by a combination of the previous listed.
APPC.07.33	The solution shall support file execution approval based on the approval of the parent file.
APPC.07.34	The solution shall support reporting of all file creation and execution in a near-real time manner.
APPC.07.35	The solution shall support the generation of a complete, accurate, and update date (within 1 hour) file inventory list of each endpoint that is reporting.
APPC.07.36	The solution shall support inventory collection from 100k managed devices with no enforcement and maintain the ability to scale upwards of one million managed devices
APPC.07.37	The solution shall support inventory collection from network shares on the defined OSes and future adoptions of new OSes
APPC.07.38	The solution shall support importing list of known file hashes into a policy from which execution mode could be Approved.
APPC.07.39	The solution shall support importing list of known file hashes into a policy from which execution mode could be Blocked and Reported.
APPC.07.40	The solution shall support importing list of known file hashes into a policy from which execution mode could be Banned and Deleted.
APPC.07.41	The solution shall report the percentage of files that are synchronized between the endpoint and the console.
APPC.07.42	The solution shall include file attributes for all files.
APPC.07.43	The solution shall include the time created for all files.
APPC.07.44	The solution shall include SHA-1 (Secured Hash Algorithm 1) hash value for all files.
APPC.07.45	The solution shall include SHA-256 (Secured Hash Algorithm 2) hash value for all files.
APPC.07.46	The solution shall include MD5 (Message Digest Algorithm) hash value for all files.
APPC.07.47	The solution shall include file type for all files.
APPC.07.48	The solution shall include file owner for all files.
APPC.07.49	The solution shall include folder path for all files.
APPC.07.50	The solution shall include product name for all files.
APPC.07.51	The solution shall include product version for all files.
APPC.07.52	The solution shall include name of signer for the digital signature for all digitally signed files.
APPC.07.53	The solution shall include time created for all files.
APPC.07.54	The solution shall include a count of instances throughout the network for all files.
APPC.07.55	The solution shall include first execution time for all file executions.
APPC.07.56	The solution shall include last execution time for all file executions.
APPC.07.57	The solution shall include executed by user for all file executions.
APPC.07.58	The solution shall include count of executions throughout the network for all file executions.
APPC.07.59	The solution shall be able to store baseline configurations.
APPC.07.60	The solution shall be able to use specified systems / images for baseline purposes.
APPC.07.61	The solution shall be able to report baseline drift of files on a specified system.
APPC.07.62	The solution shall be able to report baseline drift on an aggregation of systems across the network.
APPC.07.63	The solution shall support exporting reports in PDF (Portable Document Format File) Format.
APPC.07.64	The solution shall support exporting reports in Excel Format.
APPC.07.65	The solution shall support exporting reports in Word Format.
APPC.07.66	The solution shall support the logging of changes to made to policies.
APPC.07.67	The solution shall support the logging of changes to made to Approval Lists/Deny Lists.
APPC.07.68	The solution shall support the logging of changes to made to policy assignments.
APPC.07.69	The solution shall support the logging of changes to made to user accounts.
APPC.07.70	The solution shall support exporting of logs to SIEM (Security Information and Event Management) solution.
APPC.07.71	The solution shall support detailed summary reporting for auditing policies.
APPC.07.72	The solution shall support detailed summary reporting for auditing approved files.
APPC.07.73	The solution shall support detailed summary reporting for auditing unapproved files.
APPC.07.74	The solution shall support detailed summary reporting for auditing execution blocks.
APPC.07.75	The solution shall support detailed summary reporting for auditing user accounts.
APPC.07.76	The solution shall support log retention configurable by time.
APPC.07.77	The solution shall support log retention configurable by space.
APPC.07.78	The solution shall support log retention configurable by user events.
APPC.07.79	The solution shall support log retention configurable by console events.
APPC.07.80	The solution shall support the ability to search for files by SHA-1 Hash Value
APPC.07.81	The solution shall support the ability to search for files by SHA-256 Hash Value
APPC.07.82	The solution shall support the ability to search for files by MD5 Hash Value
APPC.07.83	The solution shall support the ability to search for files by execution time.
APPC.07.84	The solution shall support the ability to search for files by file path.
APPC.07.85	The solution shall support the ability to search for files by file name.
APPC.07.86	The solution shall support the ability to search for files by executing user.
APPC.07.87	The solution shall provide support for file execution approval by Certificates.
APPC.07.88	The solution shall utilize reputation scoring for each file.
APPC.07.89	The solution’s reputation score shall include file rarity as part of that rating.
APPC.07.90	The solution shall have and provide a mechanism for submitting suspicious files to a service for additional analysis
APPC.07.91	The solution shall include integrated mechanism for requesting ad-hoc file execution requests for review and approval by the administrators of the console.
APPC.07.92	The solution shall provide an integrated method for file review by global reputation rating.
APPC.07.93	The solution shall provide reputation rating based on trust scoring.
APPC.07.94	The solution shall provide a method or overriding provided reputation rating by the customer.
APPC.07.95	The solution shall provide an integrated method for creating a reputation for files that do not have a rating provided by the vendor.
APPC.07.96	The solution shall support specific user accounts designated for Application Program Interface (API) calls. These users shall only work with API calls and not the normal console.
APPC.07.97	The solution shall support Active directory integration for API user accounts.
APPC.07.98	The solution shall support Composite API's
APPC.07.99	The solution shall support REST (Representational State Transfer) API Architecture.
APPC.07.100	The solution shall support the SOAP (Simple Object Access Protocol) API.
APPC.07.101	The solution shall support RPC (Remote Procedure Calls) API protocol.
APPC.07.102	The solution shall support automation of configurations through API calls.
APPC.07.103	The solution shall support automation of policies through API calls.
APPC.07.104	The solution shall support automation of reports through API calls.
APPC.07.105	The solution shall support automation of endpoint management through API calls.
APPC.07.106	The solution shall support automation of console maintenance through API calls.
APPC.07.107	The solution shall support automation of user account creation through API calls.
APPC.07.108	The solution shall support automation of user account modification through API calls.
APPC.07.109	The solution shall support automation of user account deletion through API calls.
APPC.07.110	The solution shall provide support for importing and exporting policies, rules, and configurations for backup purposes.
APPC.07.111	The solution shall provide support for importing and exporting policies, rules, and configurations in SQL (Structure Query Language) format
APPC.07.112	The solution shall provide support for importing and exporting policies, rules, and configurations in word format
APPC.07.113	The solution shall provide support for importing and exporting policies, rules, and configurations in excel format
APPC.07.114	The solution shall provide support for importing and exporting policies, rules, and configurations in XML (Extensible Markup Language) format
APPC.07.115	The solution shall support policy update propagation to endpoints in less than ten minutes.
APPC.07.116	The solution shall support policy update propagation to endpoints in less than thirty minutes.
APPC.07.117	The solution shall support policy update propagation to endpoints in less than two hours.
APPC.07.118	The solution shall support policy update propagation to endpoints in less than three hours.
APPC.07.119	The solution shall support revoking execution should a file no longer be approved by the enterprise.
APPC.07.120	The solution shall include an integrated mechanism for file collection without user reliance or impact.
APPC.07.121	The solution shall support application grouping, policy and/or rule assignment by grouping.
APPC.07.122	The solution shall integrate with industry standard acceptable SIEM products
APPC.07.123	The solution shall integrate with industry standard acceptable enterprise deployment solutions (Example: SCCM, BigFix, etc)
APPC.07.124	The solution shall integrate with other industry standard acceptable endpoint protection products (An example but not limited to: Trellix, Microsoft, Symantec, etc.)
APPC.07.125	The solution shall integrate with industry standard acceptable EDR (Endpoint Detection and Response) and XDR (Extended Detection and Response) products
APPC.07.126	The solution shall integrate with industry standard acceptable asset management and monitoring products (Example: ForeScout)
APPC.07.127	The solution shall integrate with industry standard acceptable enterprise ticketing systems for tracking, change management, creation, and assignment
APPC.07.128	The solution shall not be dependent on other application versions on the endpoint.
APPC.07.129	The solution shall have a simplistic Operating System dependency model.
APPC.07.130	The solution shall adhere to the least privileged model of management that integrates with Active Directory and provides tiered access within the console.
APPC.07.131	The solution shall provide application enforcement for offline devices.
APPC.07.132	The solution shall provide for time-based policy enforcement.
APPC.07.133	The solution shall be FedRamp High Impact compliant.
APPC.07.135	The solution shall be FIPS 140-2 (Federal Information processing Standards) compliant.
APPC.07.136	The solution shall be 508 compliant.
APPC.07.137	The solution shall be capable of leveraging PIV (Personal Identity Verification) console authentication.
APPC.07.138	The solution shall have features that specifically target crypto miners.
APPC.07.139	The solution shall have features that specifically target PowerShell abuse.
APPC.07.140	The solution shall have features that specifically target ransomware.
APPC.07.141	The solution shall include a mechanism for suspicious files to be submitted for analysis via the console.
APPC.07.142	The solution shall include a mechanism for submitting files for analysis to a variety of vendors.
APPC.07.143	The solution shall provide a menu-driven option to delete or remove targeted files directly from a server or workstation.
APPC.07.144	The solution shall provide a menu driven option to quickly lockdown or quarantine the enterprise within a few minutes.
APPC.07.145	The solution shall provide detailed history of all files in the catalog that show when a file was introduced to the environment.
APPC.07.146	The solution shall provide a detailed history of all files in the catalog that show how the file was introduced to the environment.
APPC.07.147	The solution shall provide a detailed history of all files in the catalog that show when the file was approved and how it was approved.
APPC.07.148	The solution shall provide detailed history of all files in the catalog that show if the file executed or did not execute.
APPC.07.149	Vendor shall provide direct telephone technical support to engineers within a hold time of no longer than 15 minutes.
APPC.07.150	Vendor shall provide email technical support for less urgent questions.
APPC.07.151	Vendor shall provide an escalation process and contact information should technical issues fail to be resolved in a timely manner.
APPC.07.152	Vendor shall provide support for creating a support case via a web portal.
APPC.07.153	Vendor shall provide quality product documentation explaining how to perform product installation, uninstallation, explain features, and perform basic tasks.
APPC.07.154	Vendor shall provide online knowledge base articles for advanced use cases and troubleshooting steps.
APPC.07.155	Vendor ecosystem shall have user support forums where other users can pose and answer questions.
APPC.07.156	Vendor shall provide documentation for disaster recovery in the form of a step-by-step guide to restore services.
APPC.07.157	Vendor shall have supported App Control in client environments of at least 100K managed devices for over 10 years and have the proven ability to scale upwards of one million endpoints.

File details come from the government source that posted it. Updated Mar 6, 2025.