This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Subpart 12.6, as supplemented with additional information included in this notice. The NAICS Code is 334611 with a size standard of 500 employees. The Department of Health and Human Services seeks to acquire a WebInspect perpetual user license and user license annual maintenance utilizing simplified acquisition procedures in accordance with FAR 13.100, 12.603, and 12.602. The software will be used by Information Technology Auditors to perform vulnerability assessments of computer web applications and services during the normal review of operations at auditees. The software, WebInspect by SPI Dynamics, can analyze the numerous Web applications and Web services in an auditee?s environment quickly and easily and is maintained and updated daily which is critical due to the ever changing environment of the web. SPI Dynamics vulnerability database is one of the most comprehensive and accurate knowledgebases on the market. WebInspect checks for all of the following vulnerabilities: Command Execution, HTTP Compliance, SQL Injection, WebDAV Compliance, Cross-Site Scripting, SSL Strength, Directory Traversal, Certificate Analysis, Abnormal Input, Content Investigation, Parameter Overflow, Spam Gateway Detection, Buffer Overflow, Client-Side Pricing, Parameter Addition, Sensitive Developer Comments, Path Manipulation, WebServer/Web Package, Path Truncation, Identification, Character Encoding, Absolute Path Detection, MS-DOS 8.3 Short Filename, Error Message Identification, Character Stripping, Permissions Assessment, Site Search, Brute Force Authentication, Application Mapping, Known Attacks, State Management, Crawl, Directory Enumeration, Automatic Form-Filling, Web Server Assessment, SSL Support, Parameter Injection, Proxy Supp. If the OIG attempted to conduct an audit without such a product, they would be unable to properly determine if proper controls were in place during an assessment. The OIG has staff members who are familiar with the product as it is currently utilized for vulnerability assessments of their internal websites and services. By standardiziing on an existing product, the OIG can share technical expertise, troubleshooting, and operational use by all staff. This will also reduct the need for additional training from the vendor. If OIG purchased a non-standard vulnerability web assessment tool, OIG could come under scrutinization by outside peer reviews for not following internal policy of standardization that has been dictated by the current HHS Secretary. SPI Dynamics, Inc. is the exclusive manufacturer and provider. Any and all interested offerors are encouraged to submit a quote. Please request a copy of the RFQ from Clint Druk at
[email protected] if you wish to be considered for this requirement. All questions must be submitted in writing via email to Clint Druk at
[email protected] by 2:00 PM EASTERN TIME Tuesday, September 19, 2007. All quotes must be submitted via electronic copy and to the addresses and locations cited in attached solicitation by section by 10:00 AM EASTERN TIME, Thursday, September 20, 2007. Quotes shall be in .pdf or Microsoft Word format.