PD_DRAFT_Enterprise_Vulnerability_Management_Open_Spec_5_28_26.pdf

PRODUCT DESCRIPTION (PD)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Cyber Secure Operation Centers

Enterprise Vulnerability Management Maintenance and Support

Date: May 27, 2026

VA-26-00048094

PD Version Number: 2.0

TAC Number: VA-26-00048094

1.0 PRODUCT REQUIREMENTS

1.1 PURPOSE

The Department of Veterans Affairs (VA), Office of Information and Technology (OIT), Office of Information Security, requires an enterprise vulnerability management capability that supports authoritative vulnerability scanning, compliance scanning, authenticated endpoint visibility, vulnerability reporting, and operational support for VA Cybersecurity Operations Center (CSOC) Vulnerability Scanning Services (VSS).

The requirement may be satisfied through maintenance and support of VA’s existing production vulnerability management architecture, including the current Tenable Security Center product family and associated subscriptions, or through a new commercial vulnerability management capability that meets the operational outcomes, scale, security, reporting, support, compliance, and transition requirements identified in this Product Description (PD).

1.2 BACKGROUND AND CURRENT ENVIRONMENT

VA currently operates Tenable Security Center products in production to support enterprise vulnerability scanning and reporting. The current production baseline includes an enterprise license supporting approximately 1.8 million IPs, console installations across VA datacenters, a centralized director capability, continuous view/monitoring capability, and FedRAMP Moderate agent subscriptions supporting authenticated visibility for laptops, remote endpoints, and other assets that may be offline or connected through VA’s Virtual Private Network (VPN).

The existing environment supports the BOD 23-01 twice a month Asset Vulnerability Scan (AVS) operations, Payment Card Industry (PCI) compliance scans, external vulnerability scans, Authority to Operate (ATO) assessments, Security Control Assessments (SCAs), Compliance Readiness Division (CRD) support, and scans supporting remediation of Office of Inspector General (OIG) material weaknesses. The capability also supports rapid-response and ad hoc scans for emergent or imminent threats, including requests or direction from CISA, GAO, HHS, IRS, and other oversight or security organizations.

1.3 ACQUISITION APPROACH

This requirement is structured as an open-specification enterprise vulnerability management acquisition. VA is not limiting the response to a brand-name-or-equal construct. VA may fulfill the requirement through continued maintenance and support of the existing production vulnerability management architecture or through a new commercial vulnerability management solution that satisfies the required operational outcomes and minimum salient characteristics.

• Existing architecture maintenance and support approach: Offerors may propose maintenance, support renewals, subscription quantities, software updates, security patches, technical support, license activation, and associated support entitlements necessary to keep VA’s existing production architecture operational, supported, patched, and current throughout the period of performance.

• New commercial vulnerability management capability approach: Offerors may propose a commercial solution that provides equivalent or superior enterprise vulnerability management capabilities, including enterprise-scale scanning, authenticated endpoint visibility, vulnerability reporting, compliance evidence support, dashboarding, role-based access, data export, integration support, and technical support.

• Offerors proposing a new commercial capability shall clearly identify transition activities, implementation timelines, data migration or data recreation requirements, training requirements, licensing assumptions, integration dependencies, required VA actions, authorization pathway, and any operational limitations during transition.

Any proposed approach shall avoid disruption to VA’s enterprise vulnerability scanning mission.

Offerors shall describe how continuity of scanning, compliance reporting, emergency response scanning, ATO/SCA support, PCI scanning, and OIG remediation support will be maintained during the period of performance and, if applicable, during transition to a new solution.

1.4 SCOPE

The scope includes the products, subscriptions, maintenance, support, software updates, security updates, major and minor releases, problem resolution, technical support, license activation, and operational continuity necessary to sustain VA’s enterprise vulnerability management mission. For a new commercial capability, scope also includes implementation planning, transition support, configuration, integration support, training, acceptance testing, and documentation necessary for VA to determine whether the proposed capability can replace or augment the existing production environment without mission degradation.

The contractor shall provide all labor, tools, subscriptions, product access, technical support, documentation, and OEM-backed support necessary to deliver the proposed approach. VA will not accept a solution that creates an avoidable gap in enterprise vulnerability scanning, compliance evidence production, emergency scanning, or security reporting.

1.5 REQUIRED OPERATIONAL OUTCOMES

• Maintain uninterrupted enterprise vulnerability scanning and compliance scanning operations across VA.

• Support a VA enterprise footprint of approximately 1.8 million IPs and associated assets across distributed environments and datacenters.

• Support centralized management, distributed scanning, role-based administration, dashboarding, reporting, and data export.

• Support authenticated endpoint visibility for approximately 675,000 FedRAMP Moderate agents or an equivalent endpoint visibility model that meets or exceeds VA’s current operational need.

• Support ad hoc and emergency vulnerability scans for emergent threats, external oversight requests, and time-sensitive cyber response requirements.

• Provide reporting outputs sufficient to support CSOC, VSS, ATO, SCA, CRD, PCI, OIG remediation, and enterprise risk reporting requirements.

• Keep the software and/or solution current, patched, supported, secure, accessible, and operational throughout the period of performance.

1.6 MINIMUM SALIENT CHARACTERISTICS

The proposed approach shall meet or exceed the following minimum salient characteristics. Offerors shall identify whether each characteristic is satisfied through the existing architecture maintenance/support approach or through a new commercial vulnerability management capability.

EXISTING PRODUCTION ARCHITECTURE MAINTENANCE BASELINE

The following baseline identifies the current production architecture maintenance and subscription quantities associated with the existing VA environment. This baseline is provided to support pricing and response development for offerors proposing continued support of the existing architecture. Offerors proposing a new commercial capability shall use the operational outcomes and salient characteristics above to explain how their proposed solution meets or exceeds the current capability, including any transition, licensing, implementation, or migration assumptions.

Area Minimum Capability Requirement Enterprise Scale Enterprise footprint Support approximately 1.8 million IPs/assets and associated scanning operations across VA environments.

Scanning Vulnerability scanning Support authenticated and unauthenticated vulnerability scanning, including scheduled, ad hoc, external, internal, and rapid-response scans.

Endpoint Visibility Agent or equivalent model Support 675,000 FedRAMP Moderate agents or an equivalent authenticated endpoint visibility model for laptops, remote systems, and intermittently connected assets.

Management Centralized administration Provide centralized management, role-based administration, distributed scanner control, policy management, and enterprise dashboarding.

Compliance Evidence and reporting Support AVS, PCI, ATO, SCA, CRD, OIG remediation, and enterprise risk reporting needs.

Data Export and integration Support data export, dashboarding, reporting, and integration with VA operational reporting or security workflows.

Support Technical support Provide phone and web-based technical support during at least Monday through Friday, 6:00 AM to 9:00 PM Eastern Time, excluding federal holidays, unless a higher level is proposed.

Maintenance Updates and patches Provide software patches, vulnerability security updates, major and minor releases, maintenance releases, and problem resolution throughout the period of performance.

Security Authorization posture Identify FedRAMP, agency ATO/ATU, DoD authorization, or other federal authorization status for all hosted, SaaS, cloud, or managed components.

Accessibility Section 508 Comply with Section 508 standards or provide an OEM-supported remediation plan identifying deficiencies, corrective steps, responsible party, milestones, and timeline.

Transition No operational gap For any new commercial capability, provide a transition plan that maintains scanning, reporting, compliance, and emergency response continuity.

1.7 INDUSTRY RESPONSE ASSUMPTIONS AND CLARIFICATIONS

To reduce avoidable industry questions and support comparable responses, offerors shall prepare submissions using the following assumptions unless the solicitation, attachments, or Government responses provide different direction.

• Response structure: Offerors shall clearly state whether they are proposing to maintain and support the existing production architecture, provide a new commercial vulnerability management capability, or propose a hybrid/transition approach.

• Evaluation consistency: VA may evaluate different technical approaches against the same required operational outcomes and minimum salient characteristics. Offerors shall provide sufficient detail for VA to compare risk, continuity, transition impact, lifecycle cost, supportability, and mission fit.

• Current architecture information: VA will provide releasable baseline information through the solicitation or during performance as appropriate. Offerors shall identify any additional architecture details required to validate pricing, transition, implementation, or risk assumptions.

• Continuity of operations: VA cannot accept a gap in AVS, PCI, external scanning, ATO/SCA support, CRD support, OIG remediation support, emergency scanning, dashboarding, or required reporting. Any new commercial capability shall describe parallel operations, phased deployment, testing, cutover, rollback, and risk controls.

• Authorization status: Proposed cloud, hosted, SaaS, or managed components shall identify FedRAMP, agency ATO/ATU, DoD authorization, or other federal authorization status. A product that is not currently authorized for VA production use shall identify the proposed authorization pathway, estimated timeline, required Government actions, data boundary, hosting model, and limitations prior to authorization.

• Data migration: Offerors shall describe whether existing scan data, dashboards, reports, asset groupings, credentials, scan policies, user roles, exports, and evidence artifacts will be migrated, recreated, archived, or otherwise retained.

• Pricing and licensing: Offerors shall explain the licensing metric used by the proposed approach, including IPs, assets, endpoints, agents, users, scanners, consoles, cloud connectors, storage, or other cost drivers. Pricing shall separately identify subscription/software, support, professional services, migration, training, and transition costs as applicable.

• Endpoint visibility: VA identifies 675,000 FedRAMP Moderate agents as the current baseline. A new commercial capability may propose an equivalent authenticated endpoint visibility model if it provides equal or better coverage, security, reporting, scalability, and operational control.

• Section 508: Submission of a Section 508 remediation plan does not by itself guarantee technical acceptability or acceptance. The plan shall specifically identify each shortcoming, corrective step, responsible party, milestone, and proposed completion timeline.

• Acceptance testing: VA expects acceptance to include validation of enterprise scanning, authenticated endpoint visibility, dashboarding, reporting, data export, role-based administration, support access, and operational continuity.

Item # Description/Part Number Qty

1 Elite Support / PREMIUM SUPPORT (UPGRADE FROM ADVANCED SUPPORT

FOR ENTERPRISE CUSTOMERS ONLY)

PN# TECH-SUP-ELITE

POP: 7/1/2025-6/30/2026 1

2 TENABLE.SC+ INCLUDES SCANNERS, 1GB NNM – ANNUAL MAINT

PN# TSCCV-M-GS

IP Bands: 1,800,000

POP: 7/1/2025-6/30/2026

3 STANDARD TENABLE.SC CONSOLE

PN# TSCCV-STNDC-M-GS 3

4 Additional Console Subscription for Tenable.sc+ Perpetual

PN# TSCCV-AC-M-GS 5

5 TENABLE.SC DIRECTOR - ANNUAL MAINTENANCE

PN# TSC-DIR-M-GS

IP Bands: 1,800,000

POP: 7/1/2025-6/30/2026 1

6 TENABLE.SC CONTINUOUS VIEW UNLTD HOSTS SCANNERS INCLUDE

1GB PVS INCLUDED (1) 5TB LCE RENEWAL MAINT

PN# GS-LGT-ENTP-PVS-R

POP: 7/1/2025-6/30/2026 1

7 AGENTS CLOUD SERVICE FEDRAMP MODERATE

PN# AGT-CSP-FRM-GS

IP Bands: 300,000 (RENEWAL)

POP: 7/1/2025-6/30/2026

8 AGENTS CLOUD SERVICE FEDRAMP MODERATE

PN# AGT-CSP-FRM-GS

IP Bands: 375,000 (NEW)

POP: 7/1/2025-6/30/2026

Base year: 7/1/2026-6/30/2027

Tenable Customer ID# 56969

Tenable Security Center Maintenance Renewal

FOR ENTERPRISE CUSTOMERS ONLY)

PN# TECH-SUP-ELITE

POP: 7/1/2027-6/30/2028 1

2 TENABLE.SC+ INCLUDES SCANNERS, 1GB NNM – ANNUAL MAINT

PN# TSCCV-M-GS

IP Bands: 1,800,000

POP: 7/1/2027-6/30/2028

3 STANDARD TENABLE.SC CONSOLE

PN# TSCCV-STNDC-M-GS 3

4 Additional Console Subscription for Tenable.sc+ Perpetual

PN# TSCCV-AC-M-GS 5

5 TENABLE.SC DIRECTOR - ANNUAL MAINTENANCE

PN# TSC-DIR-M-GS

IP Bands: 1,800,000

POP: 7/1/2027-6/30/2028 1

6 TENABLE.SC CONTINUOUS VIEW UNLTD HOSTS SCANNERS INCLUDE

1GB PVS INCLUDED (1) 5TB LCE RENEWAL MAINT

PN# GS-LGT-ENTP-PVS-R

POP: 7/1/2027-6/30/2028 1

7 AGENTS CLOUD SERVICE FEDRAMP MODERATE

PN# AGT-CSP-FRM-GS

IP Bands: 675,000 (RENEWAL)

POP: 7/1/2027-6/30/2028

Option Year 1: 7/1/2027-6/30/2028

FOR ENTERPRISE CUSTOMERS ONLY)

PN# TECH-SUP-ELITE

POP: 7/1/2028-6/30/2029 1

2 TENABLE.SC+ INCLUDES SCANNERS, 1GB NNM – ANNUAL MAINT

PN# TSCCV-M-GS

IP Bands: 1,800,000

POP: 7/1/2028-6/30/2029

3 STANDARD TENABLE.SC CONSOLE

PN# TSCCV-STNDC-M-GS 3

4 Additional Console Subscription for Tenable.sc+ Perpetual

PN# TSCCV-AC-M-GS 5

5 TENABLE.SC DIRECTOR - ANNUAL MAINTENANCE

PN# TSC-DIR-M-GS

IP Bands: 1,800,000

POP: 7/1/2028-6/30/2029 1

6 TENABLE.SC CONTINUOUS VIEW UNLTD HOSTS SCANNERS INCLUDE

1GB PVS INCLUDED (1) 5TB LCE RENEWAL MAINT

PN# GS-LGT-ENTP-PVS-R

POP: 7/1/2028-6/30/2029 1

7 AGENTS CLOUD SERVICE FEDRAMP MODERATE

PN# AGT-CSP-FRM-GS

IP Bands: 675,000 (RENEWAL)

POP: 7/1/2028-6/30/2029

Optional Year 2: 7/1/2028-6/30/2029

FOR ENTERPRISE CUSTOMERS ONLY)

PN# TECH-SUP-ELITE

POP: 7/1/2029-6/30/2030 1

2 TENABLE.SC+ INCLUDES SCANNERS, 1GB NNM – ANNUAL MAINT

PN# TSCCV-M-GS

IP Bands: 1,800,000

POP: 7/1/2029-6/30/2030

3 STANDARD TENABLE.SC CONSOLE

PN# TSCCV-STNDC-M-GS 3

4 Additional Console Subscription for Tenable.sc+ Perpetual

PN# TSCCV-AC-M-GS 5

5 TENABLE.SC DIRECTOR - ANNUAL MAINTENANCE

PN# TSC-DIR-M-GS

IP Bands: 1,800,000

POP: 7/1/2029-6/30/2030 1

6 TENABLE.SC CONTINUOUS VIEW UNLTD HOSTS SCANNERS INCLUDE

1GB PVS INCLUDED (1) 5TB LCE RENEWAL MAINT

PN# GS-LGT-ENTP-PVS-R

POP: 7/1/2029-6/30/2030 1

7 AGENTS CLOUD SERVICE FEDRAMP MODERATE

PN# AGT-CSP-FRM-GS

IP Bands: 675,000 (RENEWAL)

POP: 7/1/2029-6/30/2030

Option Year 3: 7/1/2029-6/30/2030

NOTICE OF THE FEDERAL ACCESSIBILITY LAW AFFECTING ALL INFORMATION AND

COMMUNICATION TECHNOLOGY (ICT) PROCUREMENTS (SECTION 508)

On January 18, 2017, the Architectural and Transportation Barriers Compliance Board (Access Board) revised and updated, in a single rulemaking, standards for electronic and information technology developed, procured, maintained, or used by Federal agencies covered by Section 508 of the Rehabilitation Act of 1973, as well as our guidelines for telecommunications equipment and customer premises equipment covered by Section 255 of the Communications Act of 1934. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

1.1 SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) STANDARDS

The proposed solution and all supporting documentation, portals, dashboards, reports, training materials, and electronic content delivered under this contract shall comply with Section 508 of the Rehabilitation Act and applicable Web Content Accessibility Guidelines (WCAG) standards. Offerors shall provide a current Accessibility Conformance Report (ACR) or Voluntary Product Accessibility Template (VPAT), as applicable. If the proposed product or supporting electronic content does not fully meet applicable Section 508 requirements at the time of quote submission or delivery, the offeror/OEM shall provide a remediation plan that specifically identifies each accessibility shortcoming, the steps required to address the shortcoming, the responsible party, interim mitigation measures, and the proposed timeline for remediation. VA reserves the right to consider unresolved accessibility defects, remediation feasibility, and remediation timelines in determining technical acceptability and acceptance.

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT. These standards are found in their entirety at: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines. A printed copy of the standards will be supplied upon request.

Federal agencies must comply with the updated Section 508 Standards beginning on January 18, 2018. The Final Rule as published in the Federal Register is available from the Access Board:

https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

E205 Electronic Content – (Accessibility Standard -WCAG 2.0 Level A and AA Guidelines)

E204 Functional Performance Criteria

E206 Hardware Requirements

E207 Software Requirements

E208 Support Documentation and Services Requirements https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule

1.2 COMPATABILITY WITH ASSISTIVE TECHNOLOGY

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

1.3 ACCEPTANCE AND ACCEPTANCE TESTING

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

2.0 SHIPMENT OF HARDWARE OR EQUIPMENT

The contractor shall provide license keys, renewal keys, subscription activation, portal access, software download access, or other access provisioning required for the awarded approach prior to expiration of the existing period of coverage or before the effective start date of performance, as applicable.

Inspection: Destination Acceptance: Destination Free on Board (FOB): Destination

Ship To and Mark For:

Primary Alternate Name: Will Provide at Award Name: Will Provide at Award Address: Address:

Voice: Voice:

Email: Email:

3.0 GENERAL REQUIREMENTS

3.1 VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

3.2 SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the Integrated Control Number (ICN) in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA Master Person Index (MPI) for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of VA.

3.3 INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020

(https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile”

(https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure

Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.

https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1 https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1 https://doi.org/10.6028/NIST.SP.500-267Br1 https://doi.org/10.6028/NIST.SP.800-119

INFORMATION SECURITY CONSIDERATIONS:

There is a current VA issued A&A/ATO package for the relevant system. This COTS procurement’s specifics are not affected by the respective ATO.

All VA sensitive information shall be protected at all times in accordance with local security field office System Security Plans (SSP’s) and Authority to Operate (ATO)’s for all systems/LAN’s accessed while performing the tasks detailed in this Product Description.