Internal Network Security Monitoring Program

The Vendor is required to provide OT security and OT exposure components within the tenable OT security platform (formerly known as tenable OT) as part of its internal network security monitoring (INSM) program.
- Tenable OT software and licensing
• Three (3) years of tenable OT security platform licensing, including all required modules and features.
1. Licensing for:
• Passive network monitoring
• Active query
• Asset inventory
• Vulnerability detection
• Configuration integrity monitoring
• Behavioral anomaly detection
• API access
• SIEM, LDAP, and other supported integrations
- Industrial core platform (ICP)
• Supply one of the following ICP deployment options:
• Virtual ICP (ova/ISO)
- Estimated sensor quantities
• Control centers: two control centers, approximately 20 switches each; one virtual sensor per virtualization host, with span ports from multiple switches aggregated to that host.
• Substations: approximately 16 substations; one or more hardware sensors per site, depending on switch count.
• Generating plants: three generating plants; assume five hardware sensors per plant for pricing purposes.
- Support and maintenance
• Three (3) years of support and maintenance for the tenable OT platform, ICP, and all sensors.
• Access to updates, patches, signatures, and threat intelligence.
• Support shall be available 24 hours a day, 7 days a week, to ensure continuous internal network security monitoring (INSM) monitoring and rapid issue resolution.
• Access to tenable university training resources.
- Licensing documentation
• Licensing documentation
• Support entitlements
• Product activation details
• Bill of materials (BOM)
• Version and compatibility requirements
• Confirmation that all licensing and support covers a three-year term
- Planning and architecture support
• Validate sensor counts and placement.
• Review site lists and switch lists.
• Provide best practices for sensor deployment.
• Assist in confirming ICP sizing.
- Tuning and optimization
• Guide board through baseline learning.
• Assist in tuning policies to reduce false positives.
• Provide recommendations for maintenance windows.
• Support tuning based on observed traffic patterns.
- Workflow development
• Alert triage
• Escalation
• Change management
• Incident response
• Compliance reporting.