99--Event Log Monitoring Software for National FAA Use

The Federal Aviation Administration (FAA) Regions and Center Operations (ARC) is seeking information on technology that will provide event log monitoring to improve security for FAA servers and workstations. We are conducting a market survey to identify potential vendors to provide a log monitoring solution. The purpose of this Market Survey is to improve the Government's understanding of the current marketplace and innovative approaches that may fulfill it's mission need and gain insight into industry capabilities and best practices. This market survey does not constitute a Screening Information Request (SIR) and cannot be construed as a commitment by the Federal Government. The FAA will not be liable for any costs associated with the preparation of any responses to this announcement, nor reimburse or otherwise pay any cost incurred by any party responding to this survey. INTERESTED VENDORS: Sources capable of complying with all requirements identified in this posting may provide information regarding their capabilities totaling no more than 10 pages and submitted to arrive no later than June 30, 2005 at the following address: FAA Northwest Mt Region; Attn Kevin O'Hara ANM53A; 1601 Lind Ave SW; Renton, WA 98055 Submissions may also be made electronically via email to Kevin O'Hara at the email address above,( kevin.o'contact@example.gov ). Late submissions may not be considered. Any vendor whose product meets the specifications may be asked to submit demonstration software or perform a such a demonstration. BACKGROUND: SCENARIO ONE: FAA ARC assets to be included in a log monitoring solution consist of: Approximately 600 servers, running operating systems of Windows, Linux, Netware, POPnet NT emulator, UNIX (FreeBSD, HP, Solaris, and other) Approximately 5200 work stations. These assets are distributed among nine regions, two centers and various field sites and are geographically (but not equally) distributed across the United States. SCENARIO TWO: FAA assets to be included in a log monitoring solution consist of: Approximately 7500 servers, running operating systems of Windows, Linux, Netware, POPnet NT emulator, UNIX (FreeBSD, HP, Solaris, and other) Approximately 50,000 work stations. These assets are distributed among nine regions, two centers and various field sites and are geographically (but not equally) distributed across the United States. POTENTIAL VENDORS SHOULD SUBMIT THE FOLLOWING INFORMATION FOR EACH SCENARIO: 1. SOLUTION: The vendor should provide a description of the proposed solution to the log monitoring function. The vendor should provide information on the proposed solution relating to: a) software, hardware, storage requirements and options (including licensing options) b) system administration and user management (for example, central or distributed management) c) method of event collection (agent or network based) d) support and maintenance (initial and two follow on years) e) recommended training f) types of notifications and alerts g) reporting capabilities including ability to use third-party tools h) trend analysis features i) collection database j) other supported device monitoring (routers, firewalls, etc) 2. APPROXIMATE PRICING The vendor must provide an estimate of price and recommended implementation schedule. The estimate should include life cycle costs for the year of purchase and the following two years of operations. If appropriate to the vendors' product, the solution should be presented with options for scalability of implementation and purchase. At a minimum, provide information for implementation for servers as a first phase 3. PAST PERFORMANCE/TECHNICAL EXPERIENCE: The vendor must provide evidence of experience in providing technology similar to that in the described scope of work. Identify any similar past or current government contracts.