Attachment 1 SON.pdf

SATEMENT OF NEED (SON)

1. Project Title:

Tenable Enterprise Licenses

2. Background Information and Objective:

The Division of Technology Management (DTM) cybersecurity team has been utilizing Tenable software since 2020. On November 3, 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released Binding Operational Directive 22-01 - Reducing the Significant Risk of Known Exploited Vulnerabilities (BOD 22-01), requiring government agencies to address a catalog of known exploited vulnerabilities that carry significant risk to federal information systems within six months. With this new catalog, CISA is targeting vulnerabilities for mitigation that have known exploits and are being currently used by malicious adversaries in an ongoing manner. The initial CISA catalog includes approximately 300 Common Vulnerabilities and Exposures (CVEs) across dozens of different vendors and software products, 115 of which are either past due or due for remediation by federal agencies on November 17, 2021. In addition, there are over 175 more vulnerabilities being tracked by CISA, which federal agencies will be required to remediate by May 3, 2022. Tenable customers should use the Vulnerability Priority Rating (VPR) to help prioritize which of these 175+ CVEs need to be addressed first. While the CISA catalog is an important resource to help security professionals identify vulnerabilities to remediate, it’s still a vast number to address and it's challenging to detect them all in any single specific way. Attackers don't target what's easy to detect and fix, they target what's effective to exploit and get them closer to their end goal.

The purpose of this requisition is to procure Tenable One Enterprise license and to continue using it to detect and correct vulnerabilities that may occur. SAMHSA must protect the vast amounts of data and records it stores, including sensitive financial, health and personal information and intellectual property. SAMHSA is in need of renewing this application suite to protect from threats and vulnerabilities and conducted compliance audits. Tenable will serve as an automated vulnerability management solution that can provide comprehensive visibility into all security activity and ensure compliance.

3. Generic Name of Product:

Tenable One is an exposure management platform

4. Salient characteristics:

Vendor shall provide Tenable One Enterprise brand-name only licenses with the following salient characteristics:

An exposure management platform to gain visibility across the modern attack surface, be able to focus efforts to prevent likely attacks, and to accurately identify exposure risk to support optimal business performance. The exposure management platform shall offer:

• Vulnerability Management

• Web App Security

• Cloud Security

• Identity Security

• Attack Surface Management

• Operational Technology Security

The licenses shall include the following Tenable options for addressing the CISA vulnerabilities:

• Nessus, as a part of Tenable.sc or Tenable.io, for network-based assessments of systems that are hard-wired.

• Nessus Agents to assess remote users not consistently or ever physically plug-in to the corporate network.

• Tenable.ot to analyze industrial control systems (ICS) and supervisory control and data acquisition (SCADA) networks for the

• Tenable.io Cloud Connectors and Frictionless Assessment to have insight to what cloud virtual machine instances are configured and automatically assess them without deploying additional software or scanners.

• Tenable.ad for real-time insight into changes introducing risk and attacks.

Tenable One Enterprise License to include the following items:

• Tenable.io

• Tenable Lumin

• Tenable.ad

• Tenable.cs

• Tenable Web Application Scanning

• Attack Surface Management

• Attack Pathways

• Tenable One Security Center Plus Companion License

5. Quantity:

• Quantity 1 License for Tenable One Enterprise (Tenable.io, Tenable Lumin, Tenable.ad, Tenable.cs, Tenable Web Application Scanning, Attack Surface Management, Attack Pathways, Tenable One Security Center Plus Companion License) (TONE-ENT-GS)

• Quantity 1 License for Tenable Security Center Plus Companion (TONE-TSC-PLUSGS)

6. Anticipated Delivery / Period of Performance:

Base Year: 9/2023 to 9/2024.