D--COMPUTER PATCH MANAGEMENT SOFTWARE

NASA Kennedy Space Center (KSC) is soliciting information for potential sources foreffective IT security patch management requirements for workstations, servers and mobiledevices. The following broad requirements are representative of the requirements to covermultiple operating systems, and discuss the architecture that is required to support anEnterprise with over 80,000 plus systems in business, development, and mission supportenvironments. This list is not all-inclusive. The product shall: support commercial offthe shelf hardware and software; use commercial off the shelf operating system anddatabases; have a centralized patch management reporting capability; provide an agent tosupport as a minimum the following operating systems: Windows XP (32 bit)/ Windows XP (64bit)/ Windows Vista (32 bit)/ Windows Vista (64 bit)/ Windows 2003 Server (32 bit)/Windows 2003 Server (64 bit)/ Windows 2008 Server (32 bit)/ Windows 2008 Server (64 bit)/Macintosh OS X/ Red Hat Linux/ Solaris (SUSE Linux/HPUX/AIX/Other Linux Distributionspreferable as well); integrate with an Enterprise wide authentication or naminginfrastructure; handle patch and package deployment in a distributed network topology;provide a centralized patch management reporting capability to include reports by devicename, IP address, customize reporting, and ability to export reports to XLS or CVS (as aminimum); be able to patch in a virtualized environment; use certificate or hash baseddeployment to enable trusted deployments; provide capability for encrypted networktraffic from agent and server; be able to handle air gap servers with multiple agents onnetworks that are not connected to the NASA business networks; provide 24X7 tech supportfor the patch management server and agent; Section 508 compliant. Additionally theproduct should: be scalable to support a tiered architecture; be capable to utilizeStorage Area Network (SAN) architecture for database storage; be capable to split outserver functions to dedicated servers; provide a management information system to reportvendor patches applied, missing (not applied), and in progress; allow for rollback ofpatches.Automation of IT discovery is a plus for any product. The Agency is looking forautomation to include active directory and network scanning as a minimum for anyEnterprise patch management product. Additionally, product inventory capability withability to inventory and report any changes to executable files and operating systemsover 180 day period, and have the capability to provide licensing information for theoperating system and applications. The patch management product shall provide thecapability to report on NIST SCAP FDCC required settings. This includes reporting on thecurrent NIST SCAP FDCC supported operating systems and also providing a roadmap andcapability to support the future NIST SCAP FDCC supported operating systems.The purpose of this notice is to provide NASA KSC with potential, interested, competitivesources for effective IT security patch management. Vendors having the capabilities necessary to meet or exceed the stated broad requirementsare invited to submit appropriate documentation, literature, brochures, and references.Firms having the required specialized capabilities in part or in all of the aboverequirements should submit a capability statement of a single page documenting theirability and past experience in performing similar efforts as described above. Vendors arerequested to include the following: name and address of firm; synopsis of relevant workperformed in the past five years, point of contact address and phone number, businesssize, NAICS/CAGE code. All responses will be forwarded to the technical team for reviewof capabilities. Contact Beverly Davis at John F. Kennedy Space Center, FL via email onlyto: contact@example.gov no later than September 30, 2009. Reference PATCH MANAGEMENTSOURCES in any response.DISCLAIMERS AND IMPORTANT NOTESAll information contained in this RFI is preliminary as well as subject to modificationand is in no way binding on the Government. FAR clause 52.215-3, Request for Informationor Solicitation for Planning Purposes is incorporated by reference in this RFI. Thegovernment does not intend to pay for information received in response to this RFI. Responders to this invitation are solely responsible for all expenses associated withresponding to this RFI. This RFI is issued solely for information and planning purposesand does not constitute a solicitation. No proprietary or classified information shouldbe submitted. Respondents are advised that NASA KSC is under no obligation toacknowledge receipt of the information received, or provide feedback to respondents withrespect to any information submitted under this RFI. In accordance with FAR 15.201(e),responses to this RFI are not offers and cannot be accepted by the Government to form abinding contract.