Software License and Maintenance Support for Computer Network Vulnerability Scanner

I. INTRODUCTION This is a combined synopsis/solicitation for commercial software license and maintenance support in accordance with FAR 12.603, as supplemented with the additional information included in this notice. II. PRODUCT INFORMATION The U.S. Department of Education, Office of Federal Student Aid (FSA) is procuring a software license and maintenance support for the performance of computer network software scanning to meet FISMA requirements for proactive risk reduction and continuous system monitoring of possible security risks and vulnerabilities. The product should provide secure, prompt, and reliable detection of a vast range of security system holes, analyze the data collected, locate vulnerabilities and possible errors in server tuning options, and suggest proper solutions. The product must provide effective network auditing and vulnerability management, and should include features such as network discovery and mapping, asset prioritization, vulnerability assessment reporting and remediation tracking according to business risk. The product should allow users the flexibility to discover network attached devices, scan specific ports and services (narrow scan scope or conditions - single device or condition) without needing to scan other parts of the network, manage scanning depth and other options for speed-optimized network scanning, scan multiple networks simultaneously, and review detailed scan session lot in HTML and other formats, such as PDF and RTF. The product should be able to provide XML based output files. The product should be able to provide centralized reports, verified remedies, and full remediation workflow capabilities for identified problems. The comprehensive reports on vulnerabilities should include features such as severity levels, time to fix estimates and impact on business, and trend analysis on security issues. The interface should be user-friendly and simple. The product should automatically and periodically update with the most current security information to guarantee continued network protection. The product should be IPv6 capable. Optimally, the product should reduce FSA's time discovering, researching, scanning and fixing network/server exposures (vulnerabilities) and enables it to eliminate vulnerabilities before they can be exploited. The scanning product will be hosted on a Federal Desktop Core Configuration (FDCC) VISTA PC or Microsoft Windows Server 2003/2008, or as a hardware appliance within a data center. III. INSTRUCTIONS TO QUOTERS The proposed software solution shall be: o a COTS product o Compliant with Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. 794d). o Compatible with Federal Desktop Core Configuration (FDCC) VISTA PC or Microsoft Windows Server 2003/2008, or as a hardware appliance within a data center. Although the government is most interested in identifying small business sources, this solicitation is not a small business set-aside. Interested parties shall submit their response via electronic mail to the individuals identified below in the specified format: (a) Quote for the license and maintenance of the proposed product(s) including two (2) one-year option periods for maintenance renewal out-years. (Maximum of 2 pages in MS Word 2007 or Adobe Acrobat 8). (b The Government shall evaluate quotes on the total cost, and the award decision shall be based on best value determination. Quotes shall be valid for 180 calendar days from the date of submission. The Government strongly encourages a discount on the cost for the base and options periods. Responses to this notice shall be sent to Nicole O'Neal at Nicole.Oneal@ed.gov and Dega Hussen at Dega.Hussen@ed.gov. Due Date: Friday, September 17, 2010 at 5:00 PM EST. All interested parties must respond by the due date and time. No extensions or exceptions will be granted. Additional Terms and Conditions are attached.