The file's text, extracted by GovTribe without its formatting.
ATTACHMENT X
Cloud-hosted Cyber Asset Attack Surface Management (CAASM)
Solicitation #: BPM056393
Requirements Compliance Checklist
For each section below, indicate whether the proposed product meets all requirements by marking the appropriate checkbox. Use the Notes column to provide any additional context or clarification
SECTION 2.3 — FUNCTIONAL REQUIREMENTS
2.3.1 Platform and Governance
| Item |
| Requirement Component |
| Yes |
| No |
| Notes |
| 1 |
| Supports native multi-tenant architecture |
| ☐ |
| ☐ |
| 2 |
| Enforces logical data isolation between tenants |
| ☐ |
| ☐ |
| 3 |
| Independent administrative configurations per tenant (RBAC) |
| ☐ |
| ☐ |
| 4 |
| Custom data retention policies per tenant |
| ☐ |
| ☐ |
| 5 |
| Tenant-specific third-party integrations |
| ☐ |
| ☐ |
| 6 |
| Global admin interface aggregating telemetry and metrics |
| ☐ |
| ☐ |
| 7 |
| Cross-tenant resource allocation limits |
| ☐ |
| ☐ |
| 8 |
| Integrates with Entra ID / Active Directory |
| ☐ |
| ☐ |
| 9 |
| Supports MFA enforcement |
| ☐ |
| ☐ |
| 10 |
| Supports SSO via SAML 2.0 or OIDC |
| ☐ |
| ☐ |
2.3.2 Asset Discovery and Inventory
| Item |
| Requirement Component |
| Yes |
| No |
| Notes |
| 1 |
| Ingests asset telemetry from authoritative systems |
| ☐ |
| ☐ |
| 2 |
| Normalizes records into a single authoritative asset record |
| ☐ |
| ☐ |
| 3 |
| Admin controls for deduplication and reconciliation logic |
| ☐ |
| ☐ |
| 4 |
| Parses physical, virtual, cloud, and network assets |
| ☐ |
| ☐ |
| 5 |
| Parses IoT and OT devices |
| ☐ |
| ☐ |
| 6 |
| Reconciles agent-based and agentless telemetry |
| ☐ |
| ☐ |
| 7 |
| Records first-seen and last-seen timestamps |
| ☐ |
| ☐ |
| 8 |
| Extracts open ports and active services |
| ☐ |
| ☐ |
| 9 |
| Supports custom tags and metadata |
| ☐ |
| ☐ |
| 10 |
| Maps relationships (asset-to-owner, asset-to-application) |
| ☐ |
| ☐ |
2.3.3 Vulnerability and Risk Correlation
| Item |
| Requirement Component |
| Yes |
| No |
| Notes |
| 1 |
| Ingests vulnerability findings from scanners, EDR, CSPM |
| ☐ |
| ☐ |
| 2 |
| Correlates vulnerabilities to unified asset records |
| ☐ |
| ☐ |
| 3 |
| Normalizes vulnerability data to prevent duplicates |
| ☐ |
| ☐ |
| 4 |
| Calculates and assigns risk prioritization scores |
| ☐ |
| ☐ |
| 5 |
| Configurable risk scoring engine |
| ☐ |
| ☐ |
| 6 |
| Aggregates vulnerability data by tenant/group/tag |
| ☐ |
| ☐ |
| 7 |
| Captures historical trending data |
| ☐ |
| ☐ |
2.3.4 Identity and User Visibility
| Item |
| Requirement Component |
| Yes |
| No |
| Notes |
| 1 |
| Ingests identity objects (users, groups, service accounts) |
| ☐ |
| ☐ |
| 2 |
| Ingests identity metadata (status, email, last auth) |
| ☐ |
| ☐ |
| 3 |
| Correlates assets with associated identities |
| ☐ |
| ☐ |
| 4 |
| Displays hostnames/device IDs mapped to identities |
| ☐ |
| ☐ |
| 5 |
| Ingests and aggregates installed software inventories |
| ☐ |
| ☐ |
| 6 |
| Supports multi-variable queries (asset + vuln + identity) |
| ☐ |
| ☐ |
2.3.5 Integration and Interoperability
| Item |
| Requirement Component |
| Yes |
| No |
| Notes |
| 1 |
| Provides RESTful API access |
| ☐ |
| ☐ |
| 2 |
| Supports native/API integration with Microsoft Sentinel |
| ☐ |
| ☐ |
2.3.6 Reporting and Analytics
| Item |
| Requirement Component |
| Yes |
| No |
| Notes |
| 1 |
| Generates exportable reports |
| ☐ |
| ☐ |
| 2 |
| Allows creation and saving of custom dashboards |
| ☐ |
| ☐ |
| 3 |
| Supports natural language and visual query building |
| ☐ |
| ☐ |
2.3.7 Agentless Asset Discovery
| Item |
| Requirement Component |
| Yes |
| No |
| Notes |
| 1 |
| Provides agentless discovery (no mandatory agents) |
| ☐ |
| ☐ |
| 2 |
| API-based data aggregation |
| ☐ |
| ☐ |
| 3 |
| Passive network traffic monitoring |
| ☐ |
| ☐ |
| 4 |
| Integrates with network infrastructure for discovery |
| ☐ |
| ☐ |
| 5 |
| Documentation describes agentless architecture |
| ☐ |
| ☐ |
| 6 |
| Agent deployment optional, not required |
| ☐ |
| ☐ |
2.3.8 Pre-Built Integration Ecosystem
| Item |
| Requirement Component |
| Yes |
| No |
| Notes |
| 1 |
| ≥200 pre-built vendor-supported integrations |
| ☐ |
| ☐ |
| 2 |
| Bidirectional data exchange supported |
| ☐ |
| ☐ |
| 3 |
| Integrations include EDR/EPP |
| ☐ |
| ☐ |
| 4 |
| Integrations include IAM/Directory Services |
| ☐ |
| ☐ |
| 5 |
| Integrations include Vulnerability Management |
| ☐ |
| ☐ |
| 6 |
| Integrations include Cloud Infrastructure |
| ☐ |
| ☐ |
| 7 |
| Integrations include SIEM |
| ☐ |
| ☐ |
| 8 |
| Integrations include ITSM/CMDB |
| ☐ |
| ☐ |
| 9 |
| Integrations include MDM |
| ☐ |
| ☐ |
| 10 |
| Integrations include Network Infrastructure |
| ☐ |
| ☐ |
| 11 |
| Catalog/list of integrations provided |
| ☐ |
| ☐ |
| 12 |
| Custom integrations do NOT count toward 200 minimum |
| ☐ |
| ☐ |