skip to content
Primary navigation

External Vulnerability Management Service

MNIT's Threat and Vulnerability Management Unit (TVMU) provides External Vulnerability Management Service (EVMS) using sophisticated tools to scan for vulnerabilities and to help entities remediate and reduce cybersecurity risks.

About EVMS

TVMU uses attack-surface management and vulnerability scanning tools to provide discovery and scanning services. EVMS helps identify vulnerabilities and threats that may impact an organization’s internet-facing systems.

Key benefits

Dedicated experts with deep knowledge and experience in vulnerability assessment and management, provide:

  • Communication on high and critical vulnerabilities and risky open ports on internet-facing systems. The communication includes applicable methods for remediation.
  • Proactive remediation advice when vulnerabilities are discovered. TVMU acts in an advisory capacity; participants are responsible for correcting any issues.

Who is eligible?

MNIT currently offers this external scanning service to Minnesota counties, port cities, and Tribal Nations. 

EVMS service rates

The cost for EVMS is based on projections made at the time of the service selection and may change based on unexpected market factors. MNIT gets licenses on a yearly basis as grant funds become available and based on the level of interest from eligible entities.

Service rates are reduced through the Whole-of-State Cybersecurity Program. In cases where grant funding is not available or entities fall outside of eligibility parameters, MNIT may provide tools and services at the cost of procurement without the grant-subsidized cost reduction.

Some services might be limited based on the availability of licenses, funding, the number of participating entities, or other changes in the grant program.

Next steps

Eligible entities interested in EVMS should contact MNIT’s Cyber Navigator Team: CN.MNIT@state.mn.us.

A Cyber Navigator will schedule a meeting with your organization to provide an overview, review roles and responsibilities, answer questions, and share the required program documentation. After documents are signed, the Cyber Navigator will schedule a kick-off meeting and provide an entity-specific deployment timeline.

back to top