Security Posture Monitoring and Reporting

NOTICE OF INTENT - Brand Name Justification for NetIQ Enterprise License Agreement and Maintenance The Internal Revenue Service intends to award a contract for commercial items. We will be negotiating an award on a sole source basis to NetIQ Corporation for their proprietary software against their Federal Supply Schedule. This purchase order will be made under the Authority of FAR Part 11.105 and FAR Part 52.211-6 - Brand Name or Equal. The purchase order will include software licenses and maintenance for IRS's security compliance posture monitoring and reporting solution. The IRS is divided into three commissioner-level organizations, with its main functions in four operating divisions: Large & Mid-Size Business (LMSB), Small Business / Self-Employed (SB/SE), Wage and Investment (W&I), and Tax Exempt & Government Entities (TE/GE). The IRS also provides support for MITS TIGTA; Criminal Investigation (CI); Chief Counsel; SOI; and Appeals. The IRS currently has approximately 5,000 servers, 120,000 desktops/laptops, several mainframes and numerous routers/switches. The NetIQ solution will be used to check and report out on the IT security compliance posture of these key pieces of IRS's infrastructure. The solution will be applied to all IRS servers, laptop and desktop computers connected to the IRS network as well as standalone. IRS Security Operations stakeholder organizations formed an Integrated Project Team (IPT) and defined a set of 7 capabilities that are required to meet the IRS unique FISMA and IT Security objectives of - Ability to assess, monitor, and report effectiveness of its implemented technical security controls in accordance to policies and standards mandated by OMB and NIST. During the month of May 2008, a Proof-of-Concept was conducted by the IRS security operations stakeholder organizations (i.e., MITS AD, ES, EOPS, EUES, Cybersecurity, and Chief Counsel). IRS invited the top vendors (i.e., those who demonstrated the ability to meet IRS's business and technical requirements) to participate. The top three vendors accepted the invitation - NetIQ, nCircle, and Secure Elements. The products were evaluated against IRS business and technical requirements and the results clearly identified the NetIQ solution as being the only solution that met and exceeded all of IRS requirements. Following are the 7 functional and operational capabilities each product was evaluated against: The NetIQ solution is the only solution which meets or exceeds IRS's complex security compliance posture monitoring and reporting requirements. This includes the capability to assess, monitor, and report the effectiveness of IRS's implemented technical security controls in accordance to policies and standards mandated by OMB and NIST. Therefore, the product must be validated by NIST Security Content Automation Protocol (SCAP) program (http://nvd.nist.gov/scapproducts.cfm) and meet polices mandated by OMB M-07-11 Implementation of Commonly Accepted Security Configurations for Windows Operating Systems, OMB M-7-18 Ensuring New Acquisitions Include Common Security Configurations, and Treasury Memo: Enhanced Cyber Security Controls, dated December 20, 2007. The NetIQ solution complies with these policies and standards. The NetIQ solution is a proprietary software product owned and developed by the company. NetIQ does not allow any other company to sell or maintain its product. The delivery order will be fulfilled by one GSA FSS schedule contractor. Solicitation Number is TBD. Award will be made on or before September 30, 2008. Questions can be e-mailed to Tonya.H. Yeldell@irs.gov.