24022 Addendum I RFP Managed Security Service.pdf

ADDENDUM I

DATE: January 05, 2024

TO: ALL PROSPECTIVE OFFERORS

FROM: Toro Holt, Senior Buyer

RE: Addendum I, RFP #24022 MANAGED SECURITY SERVICE

The RFP deadline for receipt of proposals has been changed from: 3:00 P.M. ET, THURSDAY, JANUARY 11, 2024

TO: 3:00 PM, EST, THURSDAY, JANUARY 25, 2024

Pursuant to Scope of Services the following questions and answers are provided:

1. What are you currently using for endpoint protection – AV, NGAV, EDR?

We currently utilize Sophos Central

2. Currently do you have a SEIM?

NO

3. How many switches do you have in production across your environment

Approximately 200

4. How many firewalls do you have?

2 Main firewalls

5. What EDR solution do you have in place today?

Sophos Central

6. For best MDR effectiveness would you be willing to include replacement of EDR?

We are open to all suggestions and proposals. The security of the network is the highest priority.

7. Do you have an SIEM solution already implemented? If yes – what is the solution that is implemented?

No

8. If you have an SIEM solution are you getting the logs from all of the servers, network devices, EDR, and NDR to the SIEM?

9. Do you have an EDR solution implemented? If yes – What is the solution that is implemented?

Do you want us to provide the solution .

We utilize Sophos and we are interested in all solutions and recommendations that would secure our network.

10. Do you have an NDR solution implemented? If yes – What is the solution that is implemented?

Do you want us to provide the solution

No, we would want you to provide whatever services necessary to secure the network

11. How many total number of users?

Approximately 2000

12. How many Office 365 mailboxes do you have?

13. What type of office 365 licenses do you have and what quantity of each license?

Enterprise Mobility + Security G3 GCC 2060 Exchange Online (Plan1) for GCC 910 Exchange Online (Plan2) for GCC 2 Microsoft Entra ID P1 for gov 221 Microsoft Teams Audio Confer 1333 Office 365 Extra File Storage for GCC 1000 Office 365 G1 GCC 1202 Office 365 G3 GCC 219 Office 365 G5 GCC 3 Power BI Pro for GCC 6 Project Plan 3 for GCC 20 Visio Plan 2 for GCC 14 Yammer for Gov (Enterprise Yammer) 1333

14. What is the make and model of your firewall?

We currently have Cisco FTD 4110 and 2130

15. Do you have IDP/IPS services enabled in your current firewall?

Yes

16. Do you have policies and procedures that you can share for implementation of solutions to meet your organization’s needs?

https://gcicweb.gbi.state.ga.us/content/cjis-security-policy

17. When was the last penetration testing done?

6 years ago

18. Do you have any applications that is accessible from Internet?

Yes we have multiple applications that are web-based that are used throughout the network

19. What is your current patching schedule and how is patching performed? What are the systems or software’s that are patched on a regular basis?

We patch our network infrastructure as needed

20. Do you have a vulnerability scanning program in place? If not do you want us to provide the service?

We currently use Sophos and yes this is a service that will be necessary.

21. Do you have an asset management system in place?

We currently use Lansweeper

22. How many cisco phones you have?

Approximately 1600

23. How many Wifi networks are there?

We have multiple WIFI networks within our environment

24. What is the total number of devices that is connected to the internal networks including printers, scanners and any device that has an IP assigned or acquires an IP address in the network.

Approximately 4000

25. Do you need to be compliant with any regulatory compliance requirements? If Yes please specify the details.

Our network has to be CJIS Compliant

26. How do they rate their internal documentation on the SOPs on a scale 1 to 5, 5 being most current and updated.

We would rate ours a 3 and in progress actively working on updating

27. When was the last time tested their backup and recovery?

Approximately 2 weeks ago

28. When was the last time they conducted cyber incident response exercise?

Never

29. How many knowledge workers do you have?

Approximately 1700

30. How many workstations do you have?

31. What is the percentage of workstation OS types?

We have Approximately 2000 Windows based and approximately 15 MAC OS

32. How many servers do you have?

Approximately 200

33. What is the percentage of server OS types?

98% Windows 2% linux

34. How many physical locations do you have?

Approximately 50

35. Are you a current Microsoft 365 customer? If so, what are the quantity of licenses and types you own?

36. Are you using Microsoft Azure or Azure Gov, and if so please provide just a high-level summary about the workloads there.

37. Are you using AWS or AWS Gov, and if so please provide just a high-level summary about the workloads there.

NO

38. How are you purchasing your Microsoft and Azure Consumption today?

We purchase thru a 3rd party vendor.

39. Do you already have an internal Infosec Team or SOC?

No we do not have a Infosec Team

40. Are you using a SIEM (Security information and event management) solution today? If so, which SIEM vendor are you using?

41. Do you have any specific requirements or compliance reasons for needing a SIEM or Managed SIEM? If so, please share a high-level description.

42. Do you have any specific data retention requirements for SIEM Data? (ex. 3 month live, 12 month archive)

6 month archive with the option to increase

43. For SIEM Event Ingestion, which sources do you require?

a. Firewalls / WAF

b. EDR Agents

c. Microsoft Active Directory Severs

d. SSO platforms

e. Microsoft 365

f. Azure, Log Types (ex. Azure Activity, Azure AD, Azure DNS)

g. AWS, Log Types (ex. Cloudtrail, Cloudwatch, EC2)

h. SD-WAN

i. Other

We would like to implement all.

44. Do you have an EDR (end detection & response) solutions deployed, and if so which vendors?

We use Sophos

45. How many endpoint agents for each EDR vendor?

46. Are you currently using the following protection platforms:

Enterprise Mobility + Security G3 GCC 2060 Exchange Online (Plan1) for GCC 910 Exchange Online (Plan2) for GCC 2 Microsoft Entra ID P1 for gov 221 Microsoft Teams Audio Confer 1333 Office 365 Extra File Storage for GCC 1000 Office 365 G1 GCC 1202 Office 365 G3 GCC 219 Office 365 G5 GCC 3 Power BI Pro for GCC 6 Project Plan 3 for GCC 20 Visio Plan 2 for GCC 14 Yammer for Gov (Enterprise Yammer) 1333

47. Do you have a requirement for US personnel only for monitoring?

Yes

48. Do you need the MSSP to provide the endpoint security product or other protection software as part of the service or just to monitor existing products (co-managed)?

We are open to any an all proposals that will properly secure our network.

49. If the MSSP would monitor existing products, can you provide a vendor list of products, beyond what was already included in the RFP, such as endpoint security, web filtering, email security, etc.

We currently use Sophos, Cisco Umbrella, barracuda, Veeam

50. We noted the following, “ACCUG operates 24 hours per day, seven days per week, including holidays. Work performed by the vendor will be performed between the hours of 8:00AM and 5:00PM Eastern Time, Monday through Friday, unless previously arranged with IT.” We assume ACCUG wants 24/7 monitoring, but changes would be made during the 8-5 EST window? Please confirm we are correct.

This is initial implementation and setup, for issues that need immediate attention Jonathan Carter will be available as a resource and we also have personnel on call at all times on a rotational basis. Please refer to page 13 Section III E. SPECIFIC TASKS: for a detailed description of requirements of Expected Specific tasks and services listed in the RFP

51. Can you provide details on your current security infrastructure, including any existing security tools and technologies in use?

We utilize Sophos, Cisco FTD Firewalls, Barracuda, Cisco Umbrella and SolarWinds

52. What is at your two egress/endpoints points you mention in the RFP ? Firewalls ?

Cisco FTD Firewalls

53. What Endpoint Protection Platform do you have to perform detection, if any ?

Sophos

54. What DLP capabilities do you currently have to block data exfiltration ?

N/a

55. What is the architecture of your network? Please include information on remote sites, cloud services, and third-party connections if applicable.

Included in RFP Section III A

56. What are your expectations regarding incident response, particularly in terms of communication protocols and timelines? (Other than 24x7) ? Are there SLAs on incident response ?

This is a part of the process of standing up our security posture everything is being updated and rewritten. We expect critical and possible breaches to be rectified and alerted immediately.

57. Specifics on SIEM

We don’t currently utilize a SIEM

58. Can you provide specific details about your current Security Information and Event Management (SIEM) system?

N/A

59. How is your existing SIEM integrated with other security tools and technologies in your network?

60. What are the primary functionalities and capabilities you rely on in your current SIEM system?

61. The RFP stated specific Log File retention requirements, are logs currently being retained and are said logs expected to be migrated into a new SIEM as part of this effort ?

62. What is the volume of logs and events typically processed by your systems?

63. How do you currently manage and respond to alerts generated by your SIEM?

64. Are playbooks well defined ?

Needs updating

65. Do they include Remediation ?

66. How does your team utilize the SIEM for threat hunting and proactive security measures?

67. What kind of customization or specific configurations have been implemented in your current SIEM/SOC operations? Are there any specific SOAR capabilities implemented?

68. Is there any flexibility in the budget range mentioned in the RFP, especially for solutions offering additional value or innovative features?

69. Are there preferred financial terms or payment schedules?

Included in RFP Section III B #5

70. What is the expected timeline for the full implementation of the security services?

Begins immediately upon award of contracts. 7-10 days implementation and onboarding

71. Can ACCGov provide more details on the weightage of evaluation criteria such as price, technical capability, and past performance?

Everything has been provided in the RFP to submit a successful proposal.

72. Will you accept references from private sector organizations?

We are willing to accept any and all references Public Sector Preferred as stated in RFP

73. Is there an incumbent provider, and if so, can you provide incumbent details?

74. Can you elaborate on the expected contract length and any possibilities for extension?

Explained in RFP Section II A Purpose

75. Can you extend the due date as the between questions and due date for proposal submission is very short?

The due date for proposal has been extended to 25 January 2024

76. Please clarify the following from Evaluation Criteria - 5. CONTRACTOR FURNISHED EQUIPMENT including adequacy and relevancy for the performance of the requirements of the contract.

Any Equipment provided by contractor in order to fulfill the duties and responsibilities of the RFP will be considered.

77. Please confirm the estimated budget of $150,000 and $200,000 is for the first year only?

Confirmed

78. What EDR / Endpoint Protection is used? We understand previously that CrowdStrike was utilized. We are assuming this is not required to be provided as part of the offer, but that it will be integrated into the technical solution.

We utilize Sophos

79. Does ACCGov utilize a Remote Monitoring and Management solution to manage endpoints (e.g. Ninja, VSA, or similar including third party patch management)? Again, we assume this is outside the scope of this offer but will be integrated into our technical solution.

We utilize Solarwinds

80. Does ACCGov currently utilize a Protective DNS solution? If so, which one?

We utilize Cisco Umbrella

81. Does ACCGov currently utilize Ransomware Protection?

We use Sophos

82. What applications does ACCGov run beyond Office365 that require log ingest for security purposes?

We would like all available logs monitored, secured and retained

Questions and Answers are hereby added to and become a part of RFP #24022. This Addendum modifies and forms a part of the RFP Documents. All other terms and conditions remain unchanged.

Any inquiries concerning this RFP should be made to Toro Holt, Senior Buyer or Jonathan D. Carter, Security Analyst (706)-613-3075, fax (706)-425-4069 or email Jonathan.carter@accgov.com.

The Unified Government of Athens-Clarke County reserves the right to reject any and all proposals, to waive any technicalities or irregularities and to award the proposal based on the highest and best interest of the Unified Government of Athens-Clarke County.

mailto:Jonathan.carter@accgov.com