27-87814 Att F - Technical Proposal Template.docx

RFP 27-87814

TECHNICAL PROPOSAL

ATTACHMENT F

INSTRUCTIONS

· Please supply requested information in the blue-shaded areas and indicate any attachments that have been included.

· Document all attachments with which section and question they pertain to.

Mandatory Requirements (Pass / Fail) Each of the following is a pass/fail requirement. A “NO” response, or failure to substantiate a “YES,” may result in disqualification. Provide supporting documentation as an attachment where indicated.

1. Does the Respondent hold GovRAMP Authorized status as the baseline authorization for the proposed Platform and, for any component that stores, processes, or transmits federal tax information subject to IRS Publication 1075, FedRAMP High authorization — OR can the Respondent provide a documented timeline to achieve GovRAMP Authorized status within twelve (12) months of Contract execution, with FedRAMP-authorized offerings otherwise accepted on a reciprocity basis? (Attach evidence or timeline.)

2. Can the Respondent provide a minimum of three (3) U.S. state-government references for the proposed platform, including at least one (1) reference for a comparable deployment involving ingestion and analytics of log and event data at comparable scale? (Complete the Reference Form.)

3. Will the Respondent provide encryption of telemetry data in transit and at rest using current NIST-approved cryptographic standards, and hold SOC 2 Type II, ISO 27001, or equivalent third-party validation? (Attach attestations.)

4. Will the Respondent comply with the IOT Information Security Framework and execute the required Non-Disclosure Agreement to access it?

5. Will the Respondent commit in writing that State data will not be used to train or fine-tune any AI/LLM model without the State’s express authorization?

Technical Proposal Questions Provide a response in the blue-shaded area beneath each question. Where a question references the Statement of Work (Attachment K), describe how the proposed solution will meet that requirement at the State’s current scale (213 applications / 37 agencies) and at the target scale (500 applications).

Enterprise Data & Telemetry Architecture (SOW Scope of Work)

1. Describe your proposed telemetry architecture for a hybrid environment that is approximately 70-75% on-premises, including your recommended balance between centralized ingestion and federated query, and the trade-offs of each at the State’s scale. Respondent must provide end‑to‑end data‑flow diagrams depicting telemetry ingestion, processing, storage, federation, and export mechanisms, with security controls and dependency components identified.

1. Explain how your platform provides a consolidated, enterprise-consumable telemetry layer while preserving drill-down into source systems, without requiring wholesale ingestion of every data source.

1. Describe your ETL and integration capabilities and your documented compatibility with the State’s integration-platform tooling (e.g., MuleSoft) and reporting/visualization tooling (Microsoft Power BI, Tableau, ServiceNow).

1. Identify which of the State’s source domains (on-premises VMware and Cisco UCS; Azure, AWS, GCP, OCI; network; security tooling; Oracle, SQL Server, PostgreSQL, MongoDB; application telemetry) are natively supported, and identify any that are not.

Application Performance Monitoring

1. Describe how your solution provides code-level visibility, distributed tracing, and business-transaction monitoring with SLO tracking across Java, .NET, Node.js, PHP, and Python workloads.

1. Explain your support for both agent-based and agentless / OpenTelemetry-based instrumentation, and the degree of feature parity between the two methods.

1. Describe your data-retention model, including metric and full-transaction trace retention, and how the State can adjust retention by application or tier.

1. Describe your roadmap for AI-assisted root cause analysis and natural-language query, identifying current availability versus planned capability.

Digital Experience Monitoring

1. Describe your Real User Monitoring and synthetic monitoring capabilities for web and mobile, including end-user experience scoring and Core Web Vitals measurement.

1. Explain your session-replay capability and the privacy controls and PII redaction available to a government customer.

1. Describe how digital-experience metrics are correlated with underlying application and infrastructure telemetry.

Network Path & Performance Monitoring

1. Describe your synthetic network monitoring for both State-owned paths and SaaS/Internet paths, including hop-by-hop path visualization with AS/ISP identification and BGP route-change alerting.

1. Explain your DNS/DNSSEC testing, HTTP(S) timing analytics, and voice/RTC (including WebRTC) testing capabilities.

1. Describe how your platform scales to the State’s monitoring volume (not less than 168,200 monthly units, scalable to 250,000+), and how that volume is metered in your pricing model.

Infrastructure Monitoring

1. Describe your server/VM, container, and Kubernetes monitoring, including ephemeral-resource lifecycle tracking, across Windows and Linux.

1. Explain your public-cloud telemetry integration for Azure, AWS, GCP, and OCI, and your support for Cisco UCS / Intersight infrastructure.

1. Describe your cloud FinOps capabilities, including spend attribution/showback by agency and service, cost-anomaly detection, rightsizing and reserved-capacity recommendations, and tagging/allocation across all four clouds.

Application Security & Runtime Self-Protection

1. Describe your Runtime Application Self-Protection (RASP) capability, including which OWASP Top 10 categories are detected and which can be actively prevented.

1. Explain your in-application vulnerability and CVE detection, library/component analysis, and SBOM generation.

1. Describe how application-security findings integrate with ITSM remediation workflows and align with the NIST Cybersecurity Framework.

Data Analytics Describe how the Platform ingests from and interoperates with the State’s existing data analytics systems; the Platform is not required to serve as the State’s system of record for logging or as its primary SIEM.

1. Describe your analytics & event data ingestion, parsing, and normalization at a scale of approximately 3-5 TB/day program-wide (total, sustained, with headroom to peak), and your documented horizontal scalability.

1. Explain how authorized State personnel would author and run custom queries, correlations, and analytic views against ingested analytics & event data, and how those results are surfaced, alerted, and exported.

1. Describe your data-federation capability for querying third-party data lakes (e.g., Snowflake, Amazon S3, Databricks) and retained on-premises/historical data during phased migration, without full ingestion, and disclose the pricing implications under both ingestion and federation models.

1. Explain your response-workflow / SOAR integration and how it would integrate bidirectionally with the State’s existing security tooling.

ITSM / ITOM Integration & CI/CD

1. Describe your bidirectional ServiceNow integration (incident creation, status sync, closure, change linkage) and your support for the State’s Common Service Data Model (CSDM).

1. Explain your alert-correlation and episode-based noise-reduction approach and how it would help reduce alert noise from a 64% baseline to 30% or below.

1. Describe your integration with the State’s source-control and CI/CD tooling (GitHub/Actions, GitLab, Azure DevOps, Jenkins, Argo CD/Flux), including deployment markers, progressive-delivery validation with automated-rollback signaling, and DORA-style delivery metrics.

1. Explain how telemetry from ephemeral/CI resources (build runners, ephemeral containers, canary/preview environments) is priced, and what controls allow the State to scope or exclude that telemetry from billable consumption.

Artificial Intelligence, Agentic Operations & Governance

1. Describe your AI-assisted troubleshooting, automated root-cause hypothesis generation, and explainable anomaly detection, and explain how operators retain deterministic access to underlying telemetry alongside AI assistance.

1. Disclose the underlying LLM(s) used, model-hosting location(s), data-retention practices for AI-processed telemetry, and any opt-out mechanisms, with preference for U.S.-resident inference.

1. Describe your governance controls for agentic or automated actions, including human-in-the-loop approval gates, role-based authorization, and audit trails, and your alignment with the NIST AI Risk Management Framework.

1. Explain how AI and agentic capabilities are priced and metered (e.g., per investigation, per correlated alert, per token, per query, per agent, or bundled), and what usage quotas, budget caps, and consumption alerting are available. Provide fully-loaded AI cost at the 213-application and 500-application scales. In addition, provide detailed pricing tables (token, query, investigation, agent execution), scenario‑based cost examples, disclosure of all AI subprocessors, and any cost impacts associated with disabling or limiting AI capabilities.

1. Identify each AI capability as Generally Available, Limited Availability, Early Access, or Roadmap, with target GA dates for any non-GA capability.

1. Review and completed Attachment [L] – Artificial Intelligence. Confirm that you have completed this attachment.

OpenTelemetry & Data Portability

1. Describe your native OpenTelemetry collector support across metrics, traces, and logs, and disclose your OpenTelemetry open-source contribution posture.

1. Explain how the State can export historical telemetry in machine-readable, vendor-neutral formats at no additional cost throughout the term, and disclose any proprietary formats, agent protocols, or instrumentation approaches that would constrain future portability.

Compliance, Security & Data Residency

1. Describe your authorization posture (GovRAMP / FedRAMP), continuous-monitoring practices, and authorization expirations.

1. Disclose all subprocessors, third-party data integrations, data-residency options, and any cross-border data transfers, and describe your handling controls for PII, PHI, and FTI.

Customer Success, Enablement & Partnership

1. Describe the dedicated TAM/CSM model you would provide for an enterprise of 37 agencies and 213+ applications, including bandwidth, escalation, and QBR cadence.

1. Describe your training and certification programs and how they would align to the State’s 148-point Champion Maturity Scorecard and champion program.

1. Describe your proposed strategic-partnership model (executive sponsorship, a joint success plan with measurable objectives, and a cadence of strategic engagement) consistent with the program’s philosophy that observability is 30% tools and 70% people and process.

1. Describe your participation in public-sector communities of practice (e.g., NASCIO) and any state-government customer council or roadmap-input mechanism.

Implementation, Transition & Service Levels

1. Describe your implementation methodology and phased plan to reach full operational readiness for the existing 213-application portfolio within nine (9) months of Contract execution.

1. If you are not the incumbent (Cisco AppDynamics / ThousandEyes / SecureApp), describe your transition methodology, including the minimum 90-day parallel-run period; configuration migration (business transactions, health rules, dashboards, alerts); agent-migration approach; historical-data migration; and how you will ensure no degradation of citizen-facing service availability.

1. Describe how you will meet the service levels in the SOW (availability, response times, ingestion latency) and your proposed service-level credit structure.

Fraud Detection & Prevention Support (SOW Scope of Work)

1. Describe how the proposed solution supports fraud detection and prevention across the observability estate. Address: (a) detection of anomalous transaction, access, and behavioral patterns across application, infrastructure, network, and security telemetry, including how baselines and alerts are configured; (b) how fraud-relevant signals and alerts are exported to external State fraud-analytics and case-management systems over open, standards-based interfaces; (c) how scoped, role-based, audited access and reporting are provided to a designated State fraud function; and (d) the approach to tamper-evident, integrity-protected logging and the retention available for fraud investigation and evidentiary use.

Operational Technology (OT/ICS) Visibility & Logging (SOW Scope of Work)

1. Describe how the proposed solution provides visibility into and logging of the State’s operational-technology (OT) and industrial control system (ICS) environments, including transportation and roadway operational systems. Address: (a) passive discovery and inventory of OT/ICS assets and communications without disrupting operations; (b) collection and normalization of OT/ICS telemetry, flows, and logs, including supported industrial protocols; (c) correlation of OT/ICS data with IT telemetry and export to the State’s SIEM and security tooling over open, standards-based interfaces; and (d) alerting, retention, and the controls that ensure the solution does not degrade OT/ICS availability or safety.

Business Service Health & Impact Analytics (SOW Scope of Work)

1. Describe your business-service health capability: how the platform computes service status from weighted KPI and impact propagation across applications, databases, infrastructure, and network paths; how service maps and root-cause drill-down are presented; your approach to entity discovery and reusable KPI/service templating across hybrid infrastructure at statewide scale; native event correlation and root-cause grouping; and predictive/seasonal KPI baselining for critical citizen-facing services. Identify any capability delivered via a separate module or third-party product.

Generative-AI / LLM Application Observability (SOW Scope of Work)

1. Describe your capability to observe the State’s own generative-AI/LLM applications: distributed tracing of model and agent calls, model latency and error tracking, and token/consumption-cost observability. Separately, and as a desirable capability, describe any ability to monitor or audit LLM inputs and outputs for policy-violating content — data exfiltration, PII exposure, or content outside acceptable use — including whether such controls are enforced in-line or observed after the fact. Identify which capabilities are Generally Available versus Roadmap.

50. Vendor Attestation

Comply with the State of Indiana AI Policy and the State Agency AI Systems Standard as they may be updated.

Support the State's AI Readiness Assessment, including providing all information and documentation the State's Agency Privacy Officer requires to submit and obtain an AI Policy Exception.

Support required follow-up assessments annually and upon any substantial change to the AI System or its use case.

Provide just-in-time (JIT) notice content, as directed, for CPO review where AI interacts with individuals.

Not enable, deploy, or push AI features into the State environment without a granted AI Policy Exception, and report any inadvertent AI feature activation to IOT immediately.

Disable or block AI features by the method(s) prescribed by IOT where an exception is not granted.

51. AI System Disclosure — Response Tables Provide a complete response to each item. Attach supporting materials where indicated; label attachments to the corresponding item number.

A. AI System Identification & Description

Does the proposed solution constitute or contain one or more AI Systems as defined in Section 2? List each.

For each AI System, describe its purpose, the functions it performs, and the outputs it generates (predictions, recommendations, decisions, generated content).

State the level of autonomy for each AI System (fully autonomous, human-in-the-loop, human-on-the-loop, advisory only).

Identify whether each AI feature is enabled by default, optional, or delivered/updated by the Respondent post-deployment.

B. Use Case & Risk Context (supports State risk triage)

Describe the operational context: does the AI System operate in a specific, well-defined domain (narrow context) or across diverse domains (broad context)?

Identify the individuals or populations that could be affected by the AI System's outputs, and how.

Does the AI System influence decisions affecting individuals' rights, benefits, safety, or access to services? Describe.

State the Respondent's assessed risk level (High / Moderate / Low) with rationale, consistent with NIST AI RMF.

C. Data Inputs, Training & Residency

Identify the data sources and data types the AI System ingests, including any personally identifiable or sensitive information.

State whether State data (including telemetry, logs, or configuration) is used to train, fine-tune, or improve any model, and whether this can be disabled.

Describe data retention for AI inputs/outputs and where AI processing physically occurs (region/tenant); confirm alignment with State hosting preferences.

Identify any Data Sharing Agreement(s) that would be required, and any third-party subprocessors involved in AI processing.

D. Model & Technical Detail

Identify the models used (proprietary, open-source, or third-party/foundation), including provider and version where applicable.

State where each model is hosted and whether inference occurs within a State-owned tenant, vendor SaaS, or a third-party AI service.

Describe the update/change process for models and AI features, including how the State is notified and must approve changes.

Provide model documentation (model cards, evaluation/benchmark results) as attachments where available.

E. Human Oversight & Operator Controls

Describe the human oversight mechanisms, including the ability of State operators to review, override, or reject AI outputs.

Confirm that deterministic (non-AI) operator actions remain available for critical workflows.

Describe audit logging of AI actions, recommendations, and operator decisions.

F. Transparency, Notice & Explainability

Identify each point where the AI System interacts with individuals and describe the just-in-time (JIT) notice that would be presented.

Describe the explainability of AI outputs (how a recommendation or decision can be understood and justified).

Describe how AI-generated content is labeled or distinguishable from human-generated content.

G. Bias, Fairness, Privacy & Security

Describe bias and fairness testing performed on the AI System and the results/mitigations.

Describe privacy safeguards for data used by the AI System (minimization, redaction, access controls).

Describe security controls specific to the AI System, including protections against prompt injection, jailbreak, and tool misuse.

List relevant security authorizations/certifications applicable to the AI components (e.g., FedRAMP/GovRAMP scope).

H. Governance, Records & Compliance

Describe the Respondent's alignment to the NIST AI Risk Management Framework and its internal AI governance program.

Confirm the ability to fully disable AI features by IOT-prescribed methods if an AI Policy Exception is not granted.

Describe incident reporting for AI failures, harmful outputs, or unauthorized AI feature activation.

Describe how AI-generated content and interactions are retained/managed as public records consistent with Indiana records requirements (IARA guidance).

I. Required Documentation Checklist (attach)

End-to-end data-flow diagram(s) for each AI System (ingestion, processing, storage, model calls, export), with security controls identified.

Applicable contract terms / Terms & Conditions governing the AI System and any third-party AI services.

Draft Data Sharing Agreement(s), if applicable.

Model documentation (model cards, evaluation reports) and any third-party AI subprocessor list.

State AI Policy references (for Respondent awareness):

• State of Indiana Artificial Intelligence Policy (OCDO/CPO/MPH)

• State Agency Artificial Intelligence Systems Standard

• Standard: AI Readiness Assessment Methodology · Procedure: Review of AI Submissions

• NIST AI Risk Management Framework (AI RMF)

• Program contact for AI policy questions: ResponsibleData@mph.in.gov · Reference: in.gov/mph/AI