II_1_sow NESSUS SOFTWARE MAY 24.pdf

Unlimited web and telephone support

Statement of Work Nessus Professional Subscription &

Annual Maintenance Support

C.1 Introduction

This procurement is for software maintenance and support licenses and renewals.

Tenable Network Security, Inc.

Nessus Brand Professional Software - On Premise - Annual Subscription

C.2 Background

The Nessus brand Professional software is necessary and currently being used to scan non-IRS computer systems for FISMA compliance. IRS PGLD Safeguards utilizes Nessus software to provide a advanced level of computer security oversight to the more than 300 state and federal agencies (i.e. stakeholders) with Federal Taxpayer Information (FTI) kept in their automated environment. The Nessus software licenses also allows for sure capacity for the larger states with a high number of agencies receiving FTI, which must be reviewed.

C.3 Scope

This software is currently being used as a tool for the computer security reviewers during field reviews to evaluate IRS Publication 1075 compliance on systems that store, process, transmit and/or receive Federal Tax Information and are subject to IRC 6103 (p)(4) Safeguarding requirements.

Nessus Professional Software Maintenance

Nessus Professional – On Premise Annual Subscription:

o 8 Annual Renewal Licenses (Sept. 16, 2024 – Sept. 15, 2025) o 5 Annual Renewal Licenses (Sept. 16, 2024 – Sept. 15, 2025)

C.4 Tasks

The contractor shall provide software maintenance and support for 13 licenses.

C.5 Delivery

The requirements will be delivered to:

IRS Privacy, Governmental Liaison and Disclosure Office of Safeguard Attn: Ben K. Hennick

All licenses shall be sent electronically to ben.k.hennick@irs.gov

C.6 Place of Performance

TBD

C.7. Period of Performance

(8) Annual Renewal Subscription

09/16/2024 – 09/15/2025

(5) Annual Renewal Subscription

09/16/2024 – 09/15/2025

C.8. Government Furnished Property

N/A

C.9 Security Requirements

Internet Protocol version 6 (IPv6) requirements. This contract involves the acquisition of IT that uses Internet Protocol (IP) technology (see NIST 500-267 and NIST 500 281 for additional guidance on IPv6 requirements). The Contractor agrees that: (1) any system hardware, software, firmware, networked component (voice, video or data) developed, procured, or acquired in support and/or performance of this contract shall comply with IPv6 standard and interoperate with both IPv6 and IPv4 systems and products; and (2) it has IPv6 technical support for development and implementation and fielded product management available. If the Contractor plans to offer a deliverable that involves IT that is not initially compliant, the Contractor shall: (1) obtain the Contracting Officer’s approval before starting work on the deliverable; (2) provide a migration path and firm commitment to upgrade to IPv6 for all application and product features; and (3) have IPv6 technical support for development and implementation and fielded product management available.

Should the Contractor discover or is made aware of during the performance of this contract that a product or service developed, procured, or acquired in support and/or performance of this contract does not conform to the IPv6 standard, it must immediately notify the Contracting Officer’s Technical Representation and Contracting Officer of such nonconformance and act in accordance with instructions of the Contracting Officer. The Contractor agrees to bring into compliance (e.g. upgrade, modification, replacement) the nonconforming product at no cost to the Government.

C.10 Points of Contact

Contract Specialist: TBD

Contract Officer: TBD

COR:

Robert Nicks, Email: robert.nicks@irs.gov

Alternate COR:

Ben K. Hennick, Email: ben.k.hennick@irs.gov

Technical Advisor

Ben K. Hennick, Email: ben.k.hennick@irs.gov

Receipt & Acceptance

Ben K Hennick 178 South Rio Grande St Salt Lake City, UT 84101-1501 Email: ben.k.hennick@irs.gov

Robert Nicks (Alternate Contact) 600 Dr. Martin Luther King Jr. Place Room 667 Louisville, KY 40202 Email: robert.nicks@irs.gov

C.11 Section 508

IR1052.239-9000 Section 508 Information, Documentation and Support (Dec 2019)

In accordance with 36 CFR, Appendix C to Part 1194, the information and communication technology (ICT) products and product support services documentation furnished in performance of this contract shall be provided at no additional cost. The contractor shall provide information, documentation, and support relative to the supplies and services as described in the statement of work, performance work statement or statement of objectives (select one). The following technical standards and provisions have been determined to be applicable to this contract:

_X Chapter 6: Support Documentation and Services _X 601 General

_X 601.1 _X 602 Support Documentation

_X 602.1 _X 602.2 _X 602.3 _X 602.4 _X 603 Support Services

_X 603.1 _X 603.2 _X 603.3 (End of clause)

IR1052.239-9001 Section 508 Conformance (Dec 2019)

Each information and communication technology (ICT) product and/or product related service delivered under the terms of this contract, at a minimum, shall conform to the applicable accessibility standards at 36 CFR, Appendix C to Part 1194 at the level of conformance as specified in the Attachment entitled, (Please state where attachment may be found).

The following technical standards have been determined to be applicable to this contract:

Chapter 4: Hardware 401 General

401.1 402 Closed Functionality

402.1 402.2(1-6) 402.3 402.4 402.5 403 Biometrics

403.1 404 Preservation of Information Provided for Accessibility

404.1

405 Privacy 405.1

406 Standard Connections 406.1

407 Operable Parts

407.1 407.2 407.3 407.4 407.5 407.6 407.7 407.8 408 Display Screens

408.1 408.2 408.3 409 Status Indictors

409.1 410 Color Coding

410.1 411 Audible Signals

411.1 412 ICT with Two-Way Communication

412.1 412.2 412.3 412.4 412.5 412.6 412.7 412.8 413 Closed Caption Processing Technologies

413.1 414 Audio Description Processing Technologies

414.1 415 User Controls for Captions and Audio Descriptions

415.1 _X Chapter 5: Software _X 501 General

_X 501.1 _X 502 Interoperability with Assistive Technology

_X 502.1 _X 502.2 _X 502.3 _X 502.4(A-G) _X 503 Applications

_X 503.1 _X 503.2 _X 503.3 _X 503.4 _X 504 Authoring Tools

_X 504.1 _X 504.2 _X 504.3 _X 504.4 _X Chapter 7: Referenced Standards _X 701 General

_X 701.1 _X 702 Incorporation by Reference _X 702.1 702.2 _X 702.3 _X 702.4 702.5 702.6 702.7

702.8 702.9 _X 702.10

The standards do not require the installation of specific accessibility-related software or the attachment of an assistive technology device, but merely require that the ICT be compatible with such software and devices so that it can be made accessible if so required by the agency in the future.

The following functional performance criteria (36 CFR Chapter 3) apply to this contract.

_X Chapter 3: Functional Performance Criteria _X 301 General

_X 301.1 _X 302 Functional Performance Criteria _X 302.1 _X 302.2 _X 302.3 _X 302.4 _X 302.5 _X 302.6 _X 302.7 _X 302.8 _X 302.9 (End of clause)

IR1052.239.9002 Section 508 Services (Dec 2019)

All contracts, solicitations, purchase orders, delivery orders and interagency agreements that contain a requirement of services which will result in the delivery of a new or updated information and communication technology (ICT) item/product must conform to the applicable provisions of the appropriate technical standards in 36 CFR, Appendix C to Part 1194, and functional performance criteria in 36 CFR Chapter 3, unless an agency exception to this requirement exists at E202 General Exceptions .

The following technical standards and provisions have been determined to be applicable to this contract:

Chapter 4: Hardware 401 General

401.1 402 Closed Functionality

402.1 402.2(1-6) 402.3 402.4 402.5 403 Biometrics

403.1 404 Preservation of Information Provided for Accessibility

404.1 405 Privacy

405.1 406 Standard Connections

406.1 407 Operable Parts

407.1 407.2 407.3 407.4 407.5 407.6 407.7 407.8 408 Display Screens

408.1 408.2 408.3 409 Status Indictors

409.1 410 Color Coding

410.1 411 Audible Signals

411.1 412 ICT with Two-Way Communication

412.1 412.2 412.3 412.4 412.5 412.6 412.7 412.8

413 Closed Caption Processing Technologies 413.1

414 Audio Description Processing Technologies 414.1

415 User Controls for Captions and Audio Descriptions 415.1

_X Chapter 5: Software _X 501 General

_X 501.1 _X 502 Interoperability with Assistive Technology

_X 502.1 _X 502.2 _X 502.3 _X 502.4(A-G) _X 503 Applications

_X 503.1 _X 503.2 _X 503.3 _X 503.4 _X 504 Authoring Tools

_X 504.1 _X 504.2 _X 504.3 _X 504.4 _X Chapter 7: Referenced Standards _X 701 General

_X 701.1 _X 702 Incorporation by Reference _X 702.1 702.2 _X 702.3 _X 702.4 702.5 702.6 702.7

702.8 702.9 _X 702.10

The standards do not require the installation of specific accessibility-related software or the attachment of an assistive technology device, but merely require that the ICT be compatible with such software and devices so that it can be made accessible if so required by the agency in the future.

The following functional performance criteria (36 CFR Chapter 3) apply to this contract.

_X Chapter 3: Functional Performance Criteria _X 301 General

_X 301.1 _X 302 Functional Performance Criteria _X 302.1 _X 302.2 _X 302.3 _X 302.4 _X 302.5 _X 302.6 _X 302.7 _X 302.8 _X 302.9