QUESTIONS DOCUMENT.docx
DOCX document 17 KB Posted
- Solicitation number
- OIS202400148
- Issued by
-
The Legislative Branch
About this file
This document appears to be a Questions and Answers document related to a federal contract opportunity for Continuous Autonomous Penetration Testing Service. The key details are:
The government is seeking on-demand, quarterly penetration testing services that can be performed remotely using tools such as NodeZero or an equivalent. The services should cover both internal and external systems, and include a complete set of detailed reports identifying vulnerabilities and recommended fixes. The government is open to proposals from either individual professionals or companies/teams, as long as the solution is not tied to a specific vendor product. The period of performance is 9/30/24 to 9/30/25, with options for additional years. There is no preference for whether the penetration testing is performed by the vendor or the government's internal team, as long as the vendor provides the necessary tools and support.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| DESCRIPTION 1.docx | DOCX document | |
| DESCRIPTION.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Questions Document:
1. Is NodeZero SaaS version (available through AWS market place) acceptable for internal and external penetration tests? Answer: Yes.
1. I am trying to figure out if the penetration testing services you need is for us to use the NodeZero program within your environment? I am not sure how this would be a pentest.
Answer: On-demand pen testing done quarterly via tool such as or equivalent to https://www.horizon3.ai/nodezero/.
1. You would add it to your network but only turn it on every quarter for testing. This would allow testing without being physically present and have a lower cost. Also, what type of penetration testing would you want: Network Penetration Testing, Application Penetration Testing, Wireless Penetration Testing, and Social Engineering. Each would have an additional cost. I would wonder if you have any wireless connections since they would be the easiest to crack from an outside perspective (unless you use IPV-6 and 802.11ax (Wi-Fi 6)) or better exclusively. Answer: Correct. Ideally as many testing options as possible.
1. Who / What is the MDM of choice.
Answer: Unable to disclose this specifically for our organization.
1. Are you looking to re-evaluate Solutions now or in the future? Answer: No, not for MDM. For Pen testing we are selecting on-demand tool now.
1. What is the scope of this requirement. Answer: On-demand pen testing tool supported by vendor and fully administered by USCP. External and internal pen testing - quarterly.
1. Is there only a need for the Oventium APTaaS and the NodeZero AD Password Audit?
Answer: No
1. The document mentions the tools NodeZero and Oventuim APtaaS. Does this mean we need to provide the licenses for these tools or simply have experience using them?
Answer: Licenses and initial setup as well as support.
1. Should the service be delivered by an individual professional or a company/team?
Answer: No preference.
1. Does the scope cover both internal and external devices?
Answer: Yes
1. Clarify whether this specific product is required for the project, or if there is flexibility to propose an equivalent solution?
Answer: Not necessarily a specific product but equivalent is a must.
1. Is this a brand name requirement Answer: Unsure I understand this question.
1. The government's description doc lists "Includes complete set of reports”, can the government define what complete reports are? We develop reports that provide our customers with all of the detail needed to communicate to both security and IT teams to resolve vulnerabilities.
These reports include priority as well as recommended fixes.
Answer: The reports described here is exactly what is needed.
1. The government mentions a particular type of scan “NodeZero AD Password Audit” which is primarily provided by horizon3.ai. Is the governments expectation we would use that service to provide the audit or provide a similar AD Password Audit?
Answer: It would have to be equivalent service.
1. What is the period of performance of this solicitation? The government is requesting “4 autonomous penetration tests” per system.
Answer: 9/30/24 start and 1 year of length. Options years are preferred.
1. There are 5 systems listed for a total of 20 penetration tests and 4 AD Password audits.
Answer: I am unsure what 5 systems this statement above refers to. The scope is on-demand pen testing (quarterly).
1. Are all of the systems externally accessible? We assume this is the case but wanted to check Answer: No.
FYI: NodeZero is the program that provides continuous pen testing and if selected would be used by internal team as well as supported by vendor. The requirement is the capability of on-demand pen testing.
File details come from the government source that posted it. Updated .