D -- Vulnerability Assessment Scanning Tools for IT Resources

The United States Department of Agriculture (USDA), Office of Chief Information Officer (OCIO), Associate Chief Information Officer for Cyber Security, is issuing this Sources Sought as a part of market research for a USDA enterprise license to determine if there is a commercial-off-the-shelf (COTS) application to perform automated vulnerability assessment scans, not penetration testing, of USDA Information Technology (IT) resources. In addition to performing the vulnerability assessment scans of USDA IT resources, the COTS application must be scalable to handle the scanning of a large number of IP addresses efficiently and effectively; ability to scan a wide variety of operating systems and applications; ability to promptly update its vulnerability checks for newly discovered vulnerabilities; ability to perform stand alone and ad-hoc scanning in addition to scheduled scanning; ability to provide vulnerability remediation management tools; produce reports for personnel at various levels; and, the ability to provide a centralize storage mechanism for the vulnerability assessment information. Currently, USDA consists of 8 program mission areas, 29 agencies and 12 staff offices. All program mission offices and staff offices are headquartered in Washington, D.C. USDA has approximately 14,000 locations and 4,000,000 IP addresses throughout the United States and Europe. There are several hundred thousand IT assets installed and operating in all these locations. The current IT environment employs a number of different solutions based on mission area as well as agency/organization based management systems. USDA is seeking sources that have a vulnerability assessment scanning tool that can be leveraged both Department-wide and by individual USDA agencies. Responses should include information on scalability and capabilities to operate in distributed, centralized and multi-tiered environments. The USDA/OPPM/POD is seeking qualified vendors that have vulnerability assessment scanning tools available through the vendor's GSA Federal Supply Schedule or other Government-wide Acquisition Contract(s). Pending the outcome of market research, the government anticipates work to commence October 1, 2006, with four, one-year option periods. In responding to this sources sought, vendors must include their GSA FSS or GWAC number and terms and conditions (applicable to this market research); applicable NAICS code; and business size. Information should be electronically submitted (Microsoft Word 2000 compatible) to Scott C. Wolz referencing the above solicitation number, at scott.wolz@usda.gov. Telephone inquiries will not be accepted. All information should be received by the USDA/OPPM/POD contact by close of business, Wednesday, March 22, 2006. There is no solicitation document available. The government will not return or pay for information provided in response to this announcement.