RFI Asset Management and Enhancement.docx

ZERO TRUST CONTINUOUS ASSET MANAGEMENT AND ENHANCEMENTS

THIS IS A REQUEST FOR INFORMATION (RFI) ONLY. This request is for planning purposes only, and does not constitute a Request for Proposal, a Solicitation, a Request for Quote or, an indication that the Government will award a contract for the items contained in this RFI. This notice is not to be construed as a commitment on the part of the Government to award a contract, nor does the Government intend to pay for any information submitted as a result of this request. The Government does not reimburse respondents for any costs associated with submission of the information being requested or reimburse expenses incurred for responses to this RFI.

Be advised that set-aside decisions may be made based on the information provided in response to this RFI. Responses should be as complete and informative as possible.

This RFI seeks to identify an Asset Identification and Correlation solution platform to be used by the Department of Veterans Affairs (VA) Office of Information Security (OIS) and other teams within VA. The primary goals of OIS are to:

· Provide aggregated, correlated and deconflicted information from VA tools for use in reporting and for ingestion by other tools.

· Create and maintain credible, comprehensive asset, application, cryptographic and user management inventories.

· Automate correlation across multiple data sources and extrapolate enterprise relevant information, relating to security and enterprise management.

· Identify trends over time based on accrued historical data.

· Identify compliance with security policies as defined by VA.

· Discover security, licensing, tool(s) and other coverage gaps.

· Identify commercial off the shelf (COTS) software licensing usage.

· Identify underutilized or overutilized licenses to satisfy investment goals.

· Provide a console and reporting capabilities that allows VA to make informed decisions regarding all generated data points.

· Report tracking data enrichment and remediation.

The Government requests information regarding ability to provide all of the capabilities identified below. Please provide a written response with no more than 12 pages, detailing the following:

1) Contractors Information: Provide your firm’s contact information, such as name and address of firm, phone number and email address, Unique Entity Identification number and point of contact with the authority and knowledge to clarify responses with government representatives if follow ups are required.

2) Existing Contracting Vehicles: If the respondent has an applicable contract, indicate so, and include contract name(s), contract number(s) and how your existing contract(s) is/are within scope of this requirement.

3) Your company’s intent and ability to meet the set aside requirement in accordance with VAAR 852.219-73 (JAN 2023) (DEVIATION) VA Notice of Total Set-Aside for Certified Service-Disabled Veteran-Owned Small Businesses and 13 CFR §125.6, which states the contractor will not pay more than 50 percent.

4) Service-Disabled Veteran-Owned Small Business/ Veteran-Owned Small Business status under the following North American Industry Classification System (NAICS) Code: 541512 ““Computer Systems Design Services” with a Size Standard of $34 Million. and proof of verification in SBA VetCert if applicable.

The vendors’ response shall provide details on the solution including:

(All responses should include Base Year and four (4) option years)

· Hardware, software and/or cloud requirements.

· Storage requirements, including ability to store historical information for up to one (1) year or more.

· Installation requirements.

· Licensing (including type of licensing, i.e., annual, perpetual, etc.) and maintenance requirements.

· What is included with licensing and maintenance.

· Description of warranty.

· Adapter requirements.

· Description of training for government FTEs.

· 10 seats annually, if applicable one (1) week or less.

· Operation/Customization Capabilities of the Solution

· Virtual lab usage and materials

· Description of professional services provided, including FTE resources to operate the system.

· Resource needs to support implementation, operations, and maintenance of solution, including ability to provide resources for VA for implementation and management of solution.

· Any features not specifically mentioned, but which may be required and necessary for the completeness and efficient performance of the proposed solution as an operating entity.

Additionally, please provide a response to the following:

1. Licensing - What is included as part of the licensing model? (i.e., perpetual, concurrent, subscription-based, proprietary, network, other)? Is support included as a part of licensing? Does the license have the flexibility to increase licenses to your current configurations over time? Do the licenses need to be installed by the contractor or can VA install?

2. Please describe what is included in ongoing support, maintenance, updates, and performance monitoring.

3. Maintenance - What does the maintenance renewal cover (updates, patches, support, etc.)?

4. Adapters - Please indicate quantity of adapters (data fields within the IT Asset Management interfaces that allow mapping) needed to connect. Do you provide installation of adapters or are they plug and play? What is the warranty on the adapters? Is there support for installation?

5. Training - What type of Software training is offered (i.e., user training, technical training/knowledge transfer, etc.)? How many days does Software Training consist of? Is the training on-site, remote, or virtual? What is the cost of Training?

6. Please provide a Rough Order of Magnitude for two (2) million licenses, annual maintenance costs or annual licensing costs (see #2 above), any additional support costs, any additional service costs, training costs, and any costs not otherwise specified or identified.

Lastly, see Appendix A, “Detailed Operating and Capability List” below, which includes a full list of requirements that the vendor is requested to provide a response to. For each item (16 total), vendors shall provide a response indicating whether their solution is Fully Capable or Not Capable of meeting the listed requirements.

Vendors are encouraged to respond if they have the capability and/or capacity to meet the requirements listed in this RFI. The Government requests that introduction pages are kept short, responses not be inundated with artifacts, marketing materials, or peripheral content, and that the submission be readable. Responses are due NO LATER THAN April 4, 2025 at 1:00PM EST and must be made by submitting your response via email to: Luis Lozada-Santiago, Contract Specialist at luis.lozada-santiago@va.gov and Contracting Officer Joseph Jones, joseph.jones6@va.gov.

Appendix A Detailed Operating and Capability List The contractor shall provide a response to each line in the list. Responses requested for each line are Fully Capable or Not Capable.

· User interface shows tool and data source integrations and data available through the integration.

· Correlated data includes information about data sources utilized without the need of specialized engineering or custom development by VA.

· Data can be weighted so that higher weighted data takes precedence over lower weighted data.

· Data sources can be compared to identify where there are gaps in coverage.

· Available data sources can be filtered so that subsets of data can be correlated/compared/reported.

· Queries can be run in the tool to identify data that meet requirements in this appendix.

· Queries can be created, customized, saved, and modified.

· Reporting capabilities are included to show information about integrations, data sources, comparisons, correlations.

· Trending reports can be created from the asset level to the enterprise level.

· Trending data is available for at least one (1) year.

· Reports are customizable.

· Role-based access is available for multiple roles, including read-only, administrator, reporting, analyst, etc. Provide list of available roles.

· Roles can be customized.

· User interface and reports are customizable at the user, security group, and enterprise level.

· Multi-factor authentication is required for access.

· Data is available to other tools and dashboards for reporting purposes.

· Correlated assets should be able to exceed two (2) million devices, 750,000 users, 30 million vulnerabilities, five (5) million applications.

· Solution has out of the box integration capability with tools and data sources.

· Ability to develop integration capability with tools and data sources where an out of the box solution is not available.

· Incoming and outgoing integration capability exists including:

· Virtual or physical device(s)

· Mobile or non-mobile device(s)

· Internet of Things (IoT)

· Internet of Medical Things (IoMT) device(s)

· Network device(s)

· Telecom device(s)

· Integrations configurable to specify what data elements to ingest or export.

· Provide integrations for the following tools:

· ServiceNow

· eMASS

· Microsoft applications, i.e., Defender for Endpoint, Entra ID, Sentinel, etc.

· Tenable

· BigFix

· Splunk

· SCCM

· CISCO applications

· CyberArk

· Okta

· Forescout

· Workspace One

· Solarwinds

· McAfee

· Juniper Mist applications

· Provide list of other integrations available.

· Cost of integrations covered as part of the solution.

· Licenses required for integration to tool or data sources are the responsibility of the vendor.

· Create an inventory of devices connected to the network, including endpoints, networking, medical, cloud, and IoT devices.

· Compare data in inventory systems and devices connected to the network to identify:

1. Devices connected to the network that are not documented in inventory systems.

2. Devices that are reported as decommissioned but are still on the network.

3. Identify information in different tools that conflict and flag for follow-up.

· Enrich asset management inventory with information captured in inventory systems.

· Identify duplicate devices from different tools and applications and correlate data to identify as one device.

· Classify devices by type, i.e., server, workstation, networking device, mobile, medical, IoT, etc.

· Not require additional agents or scanning capabilities beyond what is done by existing tools in the environment.

· Provide real-time visibility of integration and correlated data.

· Identify the security or other boundary to which a device belongs.

· Export inventory data to multiple systems with data elements specific to each system

· Organize assets into different groups through use of combinations of assets properties, i.e., IP address or range, naming conventions, asset type, and other characteristics of a device.

· Create an inventory of software on devices connected to the network.

· Provide counts of unique software applications and total number of installations.

· Determine if applications are compliant with VA's Technical Reference Model (TRM) status.

· Provide data to determine if procured software licenses are underutilized or oversubscribed.

· Identify applications that are out of support or end of life.

· Export inventory data to multiple systems with data elements specific to each system.

· Identify tools and sensors that contain data elements for the Master Device Record (MDR) not currently captured by tools currently integrated with CDM.

· Provide integration with tools or sensors that will enrich CDM data.

· Integrate with CDM required catalogs for comparison and correlation with devices, applications, configurations, and vulnerabilities. Required catalogs include CPE, CVE, STIG, and application and OS EOL/EOS.

· Identify devices and applications not included in the MDR.

· Provide only data required by CDM from different tools and sensors to reduce data ingest requirements for the CDM Integration Layer (Splunk).

· Correlate data from vulnerability management scanning solutions and databases and provide date identified, criticality, age, last seen date, remediation date, and POAMs aligned to vulnerabilities.

· Find, track, and trend previously deployed agents that are not functioning correctly, e.g., broken, corrupted, disabled, or removed agents.

· Find, track, and trend agent version/agent hygiene.

· Find, track, and trend agents within correct security policies.

· Find, track, and trend devices with specific security conditions

· Find, track, and trend devices (workstation/server/cloud) that have not been scanned, scanned within acceptable frequency, or missing scanning agent.

· Find, track, and trend devices with critical CVE & has missing agent, broken agent, or incorrect security agent policy.

· Find, track, and trend devices with specific CVEs.

· Find, track, and trend devices with specific CVSS scores.

· Find, track, and trend devices on the network that are not part of management platforms.

· Find, track, and trend unmanaged devices that are authorized.

· Find, track, and trend unmanaged devices that are unauthorized.

· Find, track, and trend devices by location, VLAN, subnet.

· Find, track, and trend NDAA prohibited devices.

· Find, track, and trend new devices seen for the first time on the network.

· Find, track, and trend device manufacturers, rogue devices, or devices of interest.

· Find, track, and trend devices by OS type, OS version, Full OS String, and OS Build.

· Find, track, and trend devices with specific OS security patches.

· Find, track, and trend devices missing specific OS security patches.

· Find, track, and trend devices with vulnerable software per the NIST database.

· Find, track, and trend devices with unauthorized software as determined by VA TRM or other catalogs.

· Find, track, and trend devices for software name, software version, and software vendor.

· Find, track, and trend devices for unsanctioned software.

· Find, track, and trend post-migration software remnants and clean up.

· Find, track, and trend browsers, crypto mining, gambling, social media, VPN clients, cloud storage software, and conferencing software.

· Find, track, and trend potentially malicious software.

· Enrich imported CMDB Configuration Items (CIs) for additional device field context.

· Compare imported CMDB CIs to identify, track, and trend data field level information gaps.

· Compare imported CMDB CIs to identify, track, and trend device gaps between CMDB and other management consoles.

· Contrast imported CMDB CIs to calculated data fields for deconfliction.

· Reconcile CMDB CIs to identify incorrectly populated fields.

· Enrich CMDB CI tables with missing devices.

· Enrich CMDB CI tables with missing field level device details.

· Search devices by hostname, device name, asset name, or IP address for alert triage.

· Find “last used user” for devices.

· Find device admin for devices.

· Find historical device characteristics relevant to an investigation or breach.

· Find device details like OS type, OS version, patches, network interfaces, open ports, software name, software version, software vendor, vulnerabilities by CVSS, CVE or criticality, running services and processes, last seen on the network, last seen in data sources, agent coverage, agent health, agent hygiene.

· Find, track, trend, and combine devices into logical, policy-oriented groupings.

· Tag assets for grouping/policy enforcement purposes.

· Build policy framework using logical queries to surface various IT hygiene conditions including:

1. OS Type, OS Version, OS Build

2. Software name, software version, software manufacturer

3. Prohibited and potentially unsanctioned software

4. Software remnants clean up

5. Name of browser and browser version

6. Conferencing software and version

7. Agent coverage, agent version, agent health

8. Applied and missing patches

9. Vulnerability scan and scan management

· Correlation of disparate user accounts and identities across the enterprise.

· Track, trend, and manage employee user account security conditions.

· Track, trend, and manage service account security conditions.

· Track, trend, and manage high privilege accounts.

· Track, trend, and manage contractor and guest account security conditions.

· Zero trust policy and framework reconciliation.

· Track, trend, and manage user account and identity activity.

· Correlate users to devices.

· Access control

· Describe the access controls to gain access to the tool.

· Logging status of assets/applications

· Logs correlated and consolidated for storage and review.

· Describe built-in logging and audit mechanisms.

· Penetration testing

· Describe if the tool has gone through penetration testing. If so, please describe who conducted the penetration testing.

· Data in rest

· How data in rest is secured (Encryption, ciphers used, etc.)?

· Data in transit How data in motion is secured (protocols used, versions, auth schemes, etc.)?

· Gather cryptography data from networks, file systems, database systems, logs, and software packages and create an inventory.

· Provide dashboard and analytics for cryptography assets.

· Produce an associated cryptography inventory per OMB M-23-02 and related guidance.

· Provide alerting when Post-Quantum Cryptography (PQC) based SSL/TSL sessions are established on the network.

Signature-based threat detection to identify any use of PQC-based SSL/TSL sessions on the corporate network. Threat signatures include PQCs from NIST submissions for Key Exchange and Digital Signatures, as well as Hybrid PQCs, i.e., combination of existing ciphers (RSA, EDD) with newer ciphers (PQC).