Enterprise Vulnerability Management Solution

Shared Services Canada (SSC) is a Government of Canada (GC) department entrusted with the transformation and ongoing management of the IT Infrastructure for 43 departments within the GC. This specification will describe the desired capabilities for infrastructure components to support SSC’s Vulnerability Management System. Government of Canada programs and data are exposed to unknown risks due to SSC’s and its Partners lack of comprehensive visibility and monitoring capabilities within all IT environments. This impairs SSC’s ability to have a comprehensive view of existing vulnerabilities and be able to take remedial actions. The GC requires effective enterprise vulnerability management services that proactively and continuously explore and reduce risks and impacts resulting from systems being exposed while being a key enabler to the overall risk management framework SSC has a requirement to implement an Enterprise Wide Vulnerability Management Systems. This is a critical detection tool that is used on a daily basis by the SSC in order to detect and confirm threats  SSC’s project scope includes the procurement and deployment of the enterprise vulnerability management tool(s) to enterprise data centres, legacy data centres, and Internet facing infrastructure. The solution must capable of performing asset discovery and vulnerability scans up to 2,000,000 assets. SSC’s scope also includes communications and collaboration across various groups including: vulnerability management, risk management, change management, asset management, patch management, security operations, clients and external stakeholders. It is intended to result in the award of a contract for two (2) year plus three (1) one year options. On May 28, 2012, the Government of Canada announced on the Government Electronic Tendering Service that it had invoked the National Security Exception under the trade agreements in respect of procurements related to email, networks and data centres for Shared Services Canada. As a result, this requirement is subject to the National Security Exception.