RFI - Next Generation of the Assured Compliance Assessment Solution (ACAS)

The Defense Information Systems Agency (DISA) has issued a Request for Information (RFI) to explore solutions for the next generation of the Assured Compliance Assessment Solution (ACAS). This initiative aims to enhance endpoint security for the Department of Defense (DoD), focusing on scalable enterprise scanning capabilities that can accommodate approximately 11 million devices. The RFI seeks insights from industry vendors regarding advanced scanning options, covering various asset types and technologies including Internet of Things (IoT) and cloud environments. The new solution must sustain current ACAS capabilities and expand functionalities, ensuring compliance with security controls and facilitating operational technology needs. Key requirements include automated vulnerability scanning, network assessment, configuration evaluation, and compatibility with established compliance frameworks like NIST standards. The program targets a contract period from November 2025 to October 2030, with responses due by April 24, 2025. The document emphasizes the need for a flexible, robust solution that can evolve alongside emerging technologies while minimizing disruption to existing operations within the DoD framework.

The document outlines the technical requirements for a network vulnerability and compliance assessment system for government agencies. It includes extensive specifications for network discovery, automated vulnerability scanning, application assessments, and compliance with security standards such as FISMA and DoD STIGs. The system is expected to perform continuous assessments across various operating systems, including both Windows and Linux, and assess both networked and non-networked devices. Key features outlined in the requirements include the capability to assess compliance through automated scans, generate detailed reports, track vulnerabilities, and integrate with existing security protocols. The emphasis is on providing a non-disruptive scanning process that maintains the integrity of network operations while ensuring accurate incident detection and compliance reporting. Central to the purpose of this document is the need for a robust system to enhance cybersecurity measures within federal and state agencies, reflecting a proactive approach to managing vulnerabilities across diverse technological environments. The document serves as a foundational framework for government RFPs seeking trusted solutions that improve compliance and security posture across various IT infrastructures.

The Defense Information Systems Agency (DISA) is soliciting information from industry for the next generation of the Assured Compliance Assessment Solution (ACAS). This Request for Information (RFI) aims to gather insights to enhance endpoint security solutions within the Department of Defense (DoD). The ACAS is currently utilized across various DoD entities to scan approximately 11 million devices, identifying compliance and security posture. The new solution must support existing capabilities, integrate with emerging technologies like IoT and cloud, and ensure scalability while providing detailed security assessments. The RFI outlines the technical specifications required, such as agent-based and agentless scanning, automated vulnerability assessments, and support for compliance frameworks. Companies responding must detail their technological recommendations, operational support plans, and cost structures over a proposed five-year lifecycle. This RFI underscores DISA’s commitment to advancing cybersecurity measures within the DoD while seeking vendor collaboration to ensure a robust and scalable scanning solution for current and future security challenges.

The DISA Master Device Endpoint Record (MDER) outlines essential device configurations encompassing network, hardware, software settings, operational context, vulnerabilities, compliance results, and user data, necessitating weekly vulnerability scans and compliance checks. The document specifies that security configuration settings for applications should be maintained and reported monthly, particularly emphasizing DoD's minimum STIG benchmark requirements for operating systems and applications. Additionally, IAVM compliance is mandated, integrating vulnerability scan data into the reporting framework.

The document outlines the Request for Information (RFI) related to the development and deployment of a comprehensive software solution for the Department of Defense (DoD). Key topics include pricing estimates for a five-year lifecycle, operations support, and the breakdown of devices requiring software licenses—estimated at 11 million across the DoD. It confirms that companies submitting proposals can include additional documentation and may propose alternative solutions. The DoD expresses a preference for a single comprehensive solution but remains open to multi-vendor approaches that could meet all requirements. Varying vendor inquiries address topics such as technical demonstrations, compliance with regulatory standards, cloud integration, and capabilities for managing diverse assets, indicating a focus on flexibility and operational efficiency. Clarifications provide expectations for assessing security, such as the need for threat detection, event-triggered scanning, and capabilities across both online and offline environments. The document emphasizes the importance of a solution that can maintain operational continuity while embracing advancements in technology and ensuring adherence to compliance standards. Overall, the RFI reflects the DoD's intent to enhance cybersecurity measures through robust, adaptable solutions tailored to a dynamic operational landscape.

The Defense Information Systems Agency (DISA) is soliciting information from the industry for the development of the next generation of the Assured Compliance Assessment Solution (ACAS). This Request for Information (RFI) aims to identify scanning solutions capable of assessing approximately 11 million devices across the Department of Defense (DoD). The ACAS team enhances DoD's security posture by providing robust scanning tools that ensure compliance and effective vulnerability assessment. The RFI highlights the need for a scalable solution that supports various technological environments, including Internet of Things (IoT) and cloud computing, while maintaining existing capabilities. Key aspects of the proposed solution include comprehensive scanning capabilities, automated vulnerability assessments, and compatibility with diverse operating systems and devices. Responses are expected to address technical specifications, architectural integration with existing DoD systems, operational support, training, and pricing structures. The RFI stipulates a target performance timeline from November 2025 through October 2030 and seeks comprehensive feedback from vendors to aid in selecting a suitable successor to the current system. This initiative reflects DISA's commitment to evolving its cybersecurity strategies to adapt to emerging threats and technologies.