The Department of State is eyeing its Enterprise Vulnerability Scanning Solution (EVSS) for a “technical refresh” to ensure cybersecurity officials at the agency can keep pace with vulnerabilities on State Department networks.
In a performance work statement, State explains that the Cyber Protection program within the department’s Bureau of Diplomatic Security, Directorate of Cyber and Technology Security, Office of Cyber Monitoring and Operations, Cyber Operations Division manages various cyber tools to secure State’s networks and data. The program requires a solution that will provide analysis, monitoring, reporting, configuration, and policy and device management.
“The DOS Cyber Protection program requires the capability to rapidly scan, assess, and report on the security posture of the Department’s networks,” State said. “The ideal solution will evaluate both IPv4 and IPv6 addressed endpoints, applications, and infrastructure for vulnerabilities.”
This EVSS refresh will include the following objectives: functionality and capabilities; department system integration; services and support; and solution training.
The solution must have the functionality to ensure high-availability of solution management, provide credentialed vulnerability scanning of State’s 250,000 endpoints at least twice per week, provide capability to securely and automatically transmit to a syslog server, and be FedRAMP certified in the contractor solution incorporates cloud-hosted capabilities, among other aspects.
For system integration, the solution must integrate with State’s Enterprise Risk Management Platform iPost; Privileged Account Management solution, CyberArk; and data analytics solution, Splunk.
Installation services for the solution will require on-site expertise to lead installation, configuration, and optimization efforts, in addition to providing project management resources.
Further, the solution will require support by a U.S. citizen 24/7, among other requirements. Solution training must include instructor-led training, operator training, and administration training.
Responses are due by May 7, 2021.
