Description
The Department of Veterans Affairs (VA) is seeking responses to a Request for Information (RFI) for Enterprise Vulnerability Management Maintenance and Support. The VA is looking for a capability that supports authoritative vulnerability scanning, compliance scanning, authenticated endpoint visibility, vulnerability reporting, and operational support for VA Cybersecurity Operations Center (CSOC) Vulnerability Scanning Services (VSS). The requirement may be satisfied through maintenance and support of VA's existing production vulnerability management architecture or through a new commercial vulnerability management capability.
Some key points to consider include:
• The proposed approach shall meet or exceed the minimum salient characteristics, including enterprise-scale scanning, authenticated endpoint visibility, vulnerability reporting, compliance evidence support, dashboarding, role-based access, data export, integration support, and technical support.
• The proposed approach shall avoid disruption to VA's enterprise vulnerability scanning mission.
• Offerors shall describe how continuity of scanning, compliance reporting, emergency response scanning, ATO/SCA support, PCI scanning, and OIG remediation support will be maintained during the period of performance and, if applicable, during transition to a new solution.
• The proposed approach shall comply with Section 508 standards and provide a current Accessibility Conformance Report (ACR) or Voluntary Product Accessibility Template (VPAT).
• The proposed approach shall support the Social Security Number (SSN) Fraud Prevention Act of 2017 and the VA's enterprise management framework.