Attachment 1--Requirement Document.docx

Requirement Description

FOR

Tenable IO Licensing and Ancillary Services

1.0 General:

1.1 Scope: The contractor shall provide Tenable.io software licensing for scanning Web Applications and ancillary services as outlined below in support of the Indian Health Service (IHS) mission.

1.2 Background:

FY22 Vulnerability Scanning Software - IHS currently employs Tenable Security Center (SC) for network device scanning (120,000 IPs), to identify configuration and security policy violations and missing security patches, and to provide remediation guidance for vulnerabilities. The agency requires the capability of scanning the Web Applications in order to protect IHS network and data integrity. This acquisition will help IHS to expand the scanning capabilities to add devices outside the functional scope of existing scans.

By adding this capability, IHS Network and application visibility will help to view, identify, contain, respond and recover the vulnerabilities before they start penetrating the IHS network and impacting critical services causing a significant damage to the IHS mission.

This acquisition will assist IHS security staff to view the vulnerability data, gather threat intelligence, analyze the data and develop a process to understand the risk and score it to quickly assess risk, prioritize vulnerabilities, and respond to cyber threats in a timely manner.

IHS already has a large investment in Tenable.sc Continuous View. Tenable.io Web App Scanning works in conjunction with the Tenable infrastructure already in place at IHS.

1.3 Objectives:

The agency requires a solution which allows it to accomplish the following general objectives.

- Scan the web applications

- Understand the Web Application workflows and pages associated with Web Applications

- Automate scan process to reduce performance and/or operational/functional disruption risk

- Gain a better understanding of the whole function of each web application running in the IHS environment currently serving the IHS community to meet IHS Mission

- Modernize web app scanning practices to keep pace with the fast-paced expansion of modern applications

1.3 Period of Performance (PoP): The Period of Performance/license activation period shall be a base period of 12 months from time of contract/order award and four 12-month periods. The final periods of performance will be within the resulting contract line details.

2.0 Requirements:

2.1 Tenable.io Web Application Scanning

The Government requires that the application cover 300 apps, be FedRAMP Moderate and TAA compliant. The annual license/subscription to the Tenable.io Web Application Scanning shall allow IHS access to software patches, updates, and any support documents for this item.

Scanner Resiliency: Scanners should be hardened to resist unauthorized use or modification (i.e., unnecessary ports and/or unnecessary services should be closed).

Authenticated Scanning: For Moderate and High systems, the CSP must ensure authenticated scans are performed wherever possible. [RA-5(5)]

Scanning with Full Authorization: For all Moderate and High systems, the CSP must ensure that scans are being performed with full system authorization. [RA-5(5)] - Scanning must avoid typical lack of authorization issues (including lack of access to remote registry, limited registry access, limited file access, etc.).

Machine-Readable Findings: The scan output must display all scan findings with a low risk or higher in a structured, machine-readable format (such as XML, CSV, or JSON).

2.2 Ancillary Services

2.2.1 Solution Implementation. The contractor shall provide solution implementation services for integration of the Tenable.io Web Application Scanning into agency procedures. In addition to any standard support provided with the Tenable.io Web Application Scanning package, the contractor shall provide as a minimum the below areas of implementation.

2.2.1.1 Training of IHS staff with necessary daily/Adhoc operational tool administration tasks, and assisting with ATO process. This training requirement would only be required at the beginning of the base period of support

2.2.1.2 Testing the implementation with the Indian Health Services (IHS)- Division of Information Security (DIS) resources to ensure all capabilities are working as expected to meet the requirements and close the Web-Application scanning gaps.

2.2.1.3 Services in support of agency Systems Security Plan development and agency-specific security control implementation. These services should provide at a minimum the below elements.

· Architecture diagram of a solution

· System boundary (how the application will connect to IHS Network and Systems)

· FedRAMP package for SaaS application

3.0 Applicable Publications: Publications applicable to this requirement document are listed below:

Publication (Chapter/Page)

Federal Acquisition Regulation