Correlating incident data to identify specific vulnerabilities and make • recommendations that enable expeditious remediation (D) 132-45D Risk and Vulnerability Assessments (RVA) At a minimum offerors who would like to be considered for this SIN must offer the following services: Network Mapping - consists of identifying assets on an agreed upon IP • address space or network range(s). Vulnerability Scanning - comprehensively identifies IT vulnerabilities • associated with agency systems that are potentially exploitable by attackers. Phishing Assessment - includes activities to evaluate the level of awareness • of the agency workforce with regard to digital form of social engineering that uses authentic looking, but bogus, emails request information from users or direct them to a fake Website that requests information. Phishing assessments can include scanning, testing, or both and can be conducted as a one- time event or as part of a larger campaign to be conducted over several months. Wireless Assessment - includes wireless access point (WAP) detection, • penetration testing or both and is performed while onsite at a customer’s facility. Web Application Assessment - includes scanning, testing or both of outward • facing web applications for defects in Web service implementation may lead to exploitable vulnerabilities. Provide report on how to implement Web services securely and that traditional network security tools and techniques are used to access to the Web Service to only those networks and systems that should have legitimate access. Operating System Security Assessment (OSSA) - assesses the configuration • of select host operating systems (OS) against standardized configuration baselines.
• Correlating incident data to identify specific vulnerabilities and make recommendations that enable expeditious remediation (D) 132-45D Risk and Vulnerability Assessments (RVA) At a minimum offerors who would like to be considered for this SIN must offer the following services: • Network Mapping - consists of identifying assets on an agreed upon IP address space or network range(s). • Vulnerability Scanning - comprehensively identifies IT vulnerabilities associated with agency systems that are potentially exploitable by attackers. • Phishing Assessment - includes activities to evaluate the level of awareness of the agency workforce with regard to digital form of social engineering that uses authentic looking, but bogus, emails request information from users or direct them to a fake Website that requests information. Phishing assessments can include scanning, testing, or both and can be conducted as a one- time event or as part of a larger campaign to be conducted over several months. • Wireless Assessment - includes wireless access point (WAP) detection, penetration testing or both and is performed while onsite at a customer’s facility. • Web Application Assessment - includes scanning, testing or both of outward facing web applications for defects in Web service implementation may lead to exploitable vulnerabilities. Provide report on how to implement Web services securely and that traditional network security tools and techniques are used to access to the Web Service to only those networks and systems that should have legitimate access. • Operating System Security Assessment (OSSA) - assesses the configuration of select host operating systems (OS) against standardized configuration baselines.