Automated Pen Test Vulnerability Platform Request for Information (RFI).pdf

This is a Request for Information (RFI) NOTICE for Market Research ONLY. The purpose of this notice is to gain knowledge of potential Business Sources. Responses to this notice will be used by the Government to make appropriate acquisition decisions. This is not a Request For Proposal (RFP). The Government does not intend to award a contract on the based responses. All proprietary information shall be marked as such. No reimbursement will be made for any costs associated with providing information in response to this notice or any follow up information requested. The purpose of this notice is to gain knowledge of interest, capabilities and qualifications of various members of the Business Community to include Large or Small Businesses, Women-Owned Small Business (WOSB), Economically Disadvantaged Women-Owned Small Business (EDWOSB) Veteran Owned Small Business, Service- Disabled Veteran-Owned Small Business (SDVOSB), HUBZONE, 8(a), etc. The North American Industrial Classification System (NAICS) Code applicable to this acquisition is 541519. The Small Business Size Standard for this acquisition is $30M. The Government must ensure there is adequate competition among the potential pool of responsive contractors.

Scope of Work- the Transportation Security Administration (TSA) is seeking commercial off-the-shelf (COTS) that will assist TSA with emerging people, process, and technology capabilities for airport environments. The platform should be able to conduct vulnerability testing, develop security solutions, and implement solutions.

The following listed are considerations for the platform to do:

• Screening Efficiency to enable:

o Seamless security asset information sharing o Non-intrusive inspection technology o Interface with airport security sensors and scanning machines o Perform mission-critical analysis o Testing & evaluation of systems and algorithms o Draft potential scenarios/simulations of real-life situations to create potential solutions o Swab sampling assessment tool

Technical Requirements – The following security assessment of the airport CT screening lane environment has been recommended: standalone, hardened laptop platform configured with a mission-specific, customized operating system. The platform must host an integrated security assessment framework capable of performing comprehensive evaluations across the operating system, database, web application, and network appliance layers. Is this something you can offer or do you recommend something different?

All functionality must be entirely self-contained– without dependency on external infrastructure, including cloud services, internet access, or data center integration. Can you offer something like this?

The customized operating system must support the integration of commercial and open-source assessment tools (license procured separately by TSA), including but not limited to:

• Nessus or similar for operating system vulnerability testing,

• Burp Suite and HCL AppScan for Web Application vulnerability testing or similar

• AppDetective Pro or similar for database vulnerability testing, and

• Nipper Studio or similar for network fabric device vulnerability testing

If you have a different tool that offers something more intricate, please let us know. These tools must be embedded within the platform in a manner that allows for simultaneous execution via a single command or interface action, initiating all assessments in parallel to efficiently evaluate the CT screening lane equipment. The solution must ensure streamlined orchestration, output consolidation, and compliance mapping – executed entirely offline.

The following should be provided to determine capability:

• Comprehensive Automation and Integration o Full Automation: Ability to automate complex logic pathing for comprehensive assessment results from various security solutions.

o Detailed Information Technology (IT) and Operational Technology (OT) Assessments:

Conduct detailed vulnerability and compliance assessments on both IT and OT environments.

• Wide Range of Assessment Techniques o Assessment Techniques: Support asset discovery, vulnerability assessment, exploitation, post-exploitation, lateral movement, ransomware simulation, data breach exposure, and Open-Source Intelligence (OSINT) gathering.

o Automated Penetration Testing: Perform automated penetration testing and exploitation on discovered vulnerabilities.

• Specific Assessment Capabilities o Credentialed Assessments: Conduct Security Technical Implementation Guide (STIG) audit checks and other credentialed assessments automatically.

o Vendor-Specific Vulnerabilities: Discover, enumerate, and validate airport screening lane vendor-specific vulnerabilities, including embedded and Incident Command System (ICS) devices and networks.

• Advanced Reporting and Analysis o Risk-Based Guidance: Offer tailored, risk-based criticality and remediation guidance for findings.

o Detailed Reports: Generate detailed reports highlighting critical findings and providing full context.

• Performance and Flexibility o Flexible Deployment: Support deployment on air-gapped laptops, and in commercial and government cloud environments.

o Non-Disruptive: Perform assessments without impacting the live TSA airport screening environments.

• Support Package o Assistance configuring the tool for a specific environment or network o Help running the platform

• Support is available via phone, email, and web-based portal, Monday–Friday, 09:00–17:00 EST (08:00 – 17:00 EST next Business Day), excluding federal holidays.

• Technical issues are managed with a formal Problem Management process including a trouble ticket system that assigns a unique ticket number for tracking purposes

• Product updates and maintenance including all patches and software updates for both major and minor releases for the purpose of addressing all bug-fixes, security vulnerabilities, and system features and updates

• Technical diagnosis, usage, configuration, and installation support; Remote assistance; and Access to all current and relevant versions of associated user and installation documentation and manuals.

If you are interested and are capable of providing the services, please respond to this notice. Please limit your response to five (5) pages and please include the following information:

-Your company’s name, address, point of contact, phone number and email address.

-Your company’s capability to meet the requirements -Your company’s capability to perform a contract of this type and comparable work performed within the past three years to include a brief description of the project, customer’s name, phone number and address, period of performance, and dollar value of the project.

-Your Company’s Business Size (Large or Small) and Socioeconomic Status (Women Owned Small Business (WOSB), Economically Disadvantaged Women-Owned Small Business (EDWOSB) Veteran Owned Small Business, Service- Disabled Veteran-Owned Small Business (SDVOSB), HUBZONE, 8(a), etc.).

-**Please include a self-certification that your company is located in the United States and that all data is housed in storage facilities within the United States.

Responses shall only be accepted from companies that are registered in System for Award Management database. To register, go to www.sam.gov. as stated above, this notice is a market survey and is for information only, to be used for preliminary planning purposes.

Responses to this notice may be emailed to Michele.Reeves@tsa.dhs.gov and Rohan.martin@tsa.dhs.gov. telephone and facsimile responses will not be accepted. Interested parties to this notice shall respond no later than Completion of Business (COB) July 8, 2025.

http://www.sam.gov/ mailto:Michele.Reeves@tsa.dhs.gov mailto:Rohan.martin@tsa.dhs.gov