Brand_Name_JA_Redacted.pdf

PPage 2 of 4 different vendors and software products, 115 of which were due for remediation by federal agencies on November 17, 2021. In addition, there are over 175 more vulnerabilities being tracked by CISA, which federal agencies were required to remediate by May 3, 2022. We have applied Tenable and used the Vulnerability Priority Rating (VPR) module to help prioritize which of these 175+ CVEs need to be addressed first. While the CISA catalog is an important resource to help security professionals identify vulnerabilities to remediate, it’s still a vast number to address and it's challenging to detect them all in any single specific way like Tenable can do.

d. Period of Performance.

Base Year 9/2023 – 9/2024

3. Acquisition Authority. This acquisition is conducted under the authority of the Federal Acquisition Regulations (FAR) Subpart 13.106-1. (b) Soliciting from a single source. (1) For purchases not exceeding the simplified acquisition threshold, contracting officers may solicit from one source if the contracting officer determines that the circumstances of the contract action deem only one source reasonably available (e.g., urgency, exclusive licensing agreements, or industrial mobilization).

4. Market Research.

Market research conducted by SAMHSA focused on identifying a reseller with expertise using and implementing Tenable in federal government environments like SAMHSA’s. Market research quotes were received form three potential vendors. These quotes assisted in formulating the overall cost for the software licenses.

DCM conducted additional market research by querying commercial and government databases to locate potential sources. Searches were conducted utilizing the following databases:

NITAAC CIO-CS Catalog GSA eLibrary

SBA DSBS

Google Contractdirectory.gov

PPage 3 of 4

5. Justification Rationale.

The Division of Technology Management (DTM) cybersecurity team has been utilizing Tenable software since 2020. To adhere to the U.S. Cybersecurity and Infrastructure Security Agency (CISA) Binding Operational Directive 22-01 - Reducing the Significant Risk of Known Exploited Vulnerabilities (BOD 22-01), the cybersecurity team has been utilizing Tenable to detect and remediate Common Vulnerabilities and Exposures (CVEs) across the SAMHSA environment.

SAMHSA uses the Vulnerability Priority Rating (VPR) to help prioritize which of these 175+ CVEs need to be addressed first. While the CISA catalog is an important resource to help security professionals identify vulnerabilities to remediate it is still challenging to detect them all in any single specific way which is where Tenable can deliver and has been invaluable.

SAMHSA must protect the vast amounts of data and records it stores, including sensitive financial, health and personal information and intellectual property. SAMHSA is in need of renewing this application suite to protect from threats and vulnerabilities and conduct compliance audits. Tenable will serve as an automated vulnerability management solution that could provide comprehensive visibility into all security activity and ensure compliance. The Tenable software platform is a necessary cybersecurity tool in SAMHSA’s repertoire to combat ongoing cybersecurity vulnerabilities.

Brand-name:

SAMHSA is seeking to re-purchase Tenable. With Tenable One can translate technical asset, vulnerability and threat data into clear business insights and actionable intelligence for the security team. Tenable provides broad coverage spanning IT assets, cloud resources, containers, web apps and identity platforms, with threat intelligence. Tenable can focus efforts to prevent likely attacks and accurately communicate cyber risk to support optimal business performance.

6. Other Supporting Facts or Circumstances.

No other sources have expressed an interest, in writing, in the proposed acquisition.

7. Any other facts supporting the justification.

None

PPage 4 of 4