Posting ID 47QFRA22K0001- EDR_Attachment_Vendor Q and A Spreadsheet_Final.xlsx
XLSX spreadsheet 36 KB Posted
- Solicitation number
- 47QFRA22K0001
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
EDR Q&A
Question No. QUESTION RESPONSE
| 1 | Disruptive and cutting-edge technology is often first deployed in commercial environments, will CISA consider allowing offerors to use commercial past performances? | In the experience/corporate capabilities section, the Government is requesting information on company experience with building and managing EDR solutions. |
| 2 | Is CISA considering delivering the EDR capabilities as a QSMO service or is the intent of this RFI to evaluate products that would separately be implemented by federal Departments and Agencies? | The Government is requesting feedback specifically on delivering EDR capabilities and tools. The Government welcomes recommendations on how to best deploy and operationalize EDR solutions across the federal enterprise. |
| 3 | Is it CISA’s intent to ultimately acquire system integrator support and technical expertise to provide PMO, EDR product analysis of alternatives, and deployment and operations expertise across a set of approved/preferred EDR platforms (e.g. Microsoft, Crowdstrike, Carbonblack, SentinelOne, etc.)? Or is it CISA’s intent to prescribe a single approved/preferred EDR platform for ubiquitous deployment across Departments/Agencies? | The Government's intent is to advance existing federal agency EDR capabilities and investments by providing additional tools to fill identified agency EDR gaps. The Government welcomes recommendations and feedback on its overall EDR approach and the decomposed EDR requirements found in the CDM Technical Requirements Volume Two. |
| 4 | Would CISA consider a dedicated logging agent in combination with a SOAR to work with the agency EDR solutions? | The Government is open to all innovative solutions that are technically viable for CISA and the agencies. |
| 5 | As part of a CDM program, it is critical to isolate assets at the network level. Is this contractor expected to bring this solution at the network level |
| or is this being provided by another contractor/already existing? Will we be expected to integrate into the network isolation? | The Government is open to all innovative solutions that are technically viable for CISA and the agencies. See the program's posted requirements on EDR to see the current functional baseline. Please include any recommendations in the RFI response. | ||
| 6 | Regarding question 8, is CISA looking for purely technical standards, or should we include recommended programmatic performance standards, data quality standards, etc.? | The Government is seeking industry feedback, based on experience with either commercial offerings or preferably federal agencies, on appropriate technical and programmatic standards to measure the success of the EDR program across the federal enterprise. | |
| 7 | Regarding question 10, can CISA please define “non-organic”? We believe the intent is to determine which vendor can ingest another vendor’s data out of the box with no customization or professional services; is that correct? | "Non-organic" refers to an existing or operational EDR solution that is already functional and in place within an agency's environment. Interoperatiblity may include, but is not limited to, data exchanges and command and control inputs. | |
| 8 | Please confirm if using 10-point font in tables and graphics is acceptable, provided the content is easily readable. | Yes. | |
| 9 | Please confirm that the three questions listed under the Experience/Corporate Capabilities section can be provided with the 1-page limit for Contractor Information. | Yes. | |
| 10 | Please confirm if front matter (i.e., cover page, table of contents) is excluded from any page limitations. | Yes | |
| 11 | Please confirm if headers, footers, and cover page labels may be in 10-point font. | Yes | |
| 12 | Section Contractor Notification , Page 5. Can the response include diagrams, tables or video content? | ||
| Yes, and links to videos can be provided. | |||
| 13 | Section Contractor Notification, Page 5. Can additional materials be submitted with the RFI response as attachments beyond the specified response page counts? | ||
| No, responses shall be submitted within the page limit identified. | |||
| 14 | Section Contractor Notification, Page 4. Are EDR tool vendors required to hold a Facilitiy Security Clearance in order to be considered? | ||
| No. The Government is requesting industry feedback and recommendations only in this RFI. | |||
| 15 | Section Background , Page 1. As part of CISA’s approach of evaluating existing Agency EDR tooling investments and true technology needs (i.e. gaps in functionality and/or coverage), does CISA intend to limit the total number of different EDR vendor solutions across Agencies (i.e. 2 or 3 vendors) or is CISA willing to leverage a multitude of vendors provided they meet CISA and Agencies' requirements? | ||
| The Government is requesting industry feedback on its EDR approach and welcomes recommendations on how to leverage potential EDR solutions/tools across the federal enterprise. | |||
| 16 | Section Purpose, Page 2. | For Agency selected and CISA validated EDR platforms, will both the Agencies and CISA be testing potential vendor solutions? | |
| CISA will be doing thier own valdiation independently to ensure "minimums" are met. Each agency has thier own processes regarding how they downselect vendors. | |||
| 17 | Section Purpose, Page 2. Since this approach is inclusive of evaluating the existing investments Agencies have made in their EDR tooling and security processes would the Government please provide an itemized list of those investments and process so that every respondant has the same information to provide the best response from? | ||
| Specific Agency information on current EDR functionalities will not be provided at this time. Industry feedback should focus on the functional EDR requirements described in the CDM Technical Requirements Volume Two. | |||
| 18 | Section Purpose, Page 2. As part of CISA's strategy what centrally Managed Detection & Response or centrally Managed SOC being considered now or in the future across all agencies for EDR Capability? |
This RFI is focused on EDR tools and solution sets. Please refer to the Administration's EDR policy in OMB-M-22-01 for more information.
Vendor's should feel free to highlight these considerations or insights as part of their response.
| 19 | Section Information Requested, Page 4. | Which Impact Levels / Security Classifications will this solution be required to monitor to achieve the Goverment's desired coverage of endpoints across the Federal Enterprise? What is the breakdown of # of Sub-Organizations and # of Endpoints desired to be managed at each unique Impact Level or Security Classification? |
| Each Agency and thier selection criteria are different. Other than federal-wide requirements that are legally mandated (e.g. FIPS), agencies' unique envionrments and needs will drive these requirements. this RFI is focused on non-classified networks/SBU and/or FOUO levels. | ||
| 20 | Section Information Requested, Page 4. Would the Government please provide a scenario to assist in communicating the design? For Example: DOT, whould autonomy be given to DOT, FAA, or a Sub-Organization of FAA? |
| While each Agency's requirements and design may differ, minimally the Government expects some technical means to provide sub-agency levels of autonomy while maintaining enterprise-level visibility and control (i.e. a centralized model for a theoretical agency-level security operations team, which can delegate to more sub-agency level teams). Sub-agency is defined as 1 organizational layer beyond the parent agency (e.g. DOT / FAA) | |
| 21 | Section Information Requested, Page 4. Would the Government please provide a full list of Departments, Agencies, and Sub-Organizations in the scope of this design? For instance - are DOE labs included, or just DOE HQ? Is FBI included as part of DoJ? |
| All Federal Civilian Executive Branch agencies. | |
| 22 | Section Information Requested, Page 4. Would it be preferred if this EDR solution could operate across all Impact Levels of a given Agency or Department? |
| Yes. | |
| 23 | Section Information Requested, Page 4. Is it preferred if "Exhaustive and complete visibility and control of all known endpoints" be available for the Federal Enterprise or just for each Department or Agency? |
| The RFI's scope for this terminology is looking at a "per agency" enterprise, minimally. | |
| 24 | Section Requirement Objectives, Page 3. Is it preferred that EDR Security Policy recommendations could be automated from the Federal Enterprise to each Agency, with the ability to allow each Agency to override a policy? |
| Please see the list of requirements in the CDM Technical Requirements Volume Two document here https://www.gsa.gov/cdnstatic/Integrated_Technology_Services/CDM-PROG-2021-CDM%20Technical%20Volume%202_v24.pdf | |
| 25 | Section Requirement Objectives, Page 3. EO 14028 emphasizes a "cloud first" approach to fortifying the Goverment's security posture. In light of this, is there a preference for SaaS-based solutions? |
| The Government invites industry recommendations and feedback as it pertains to EDR tools and solution sets, including whether the Government should consider Saas-based solutions. | ||
| 26 | What is your current log retention plan? Do you plan on archiving logs into an external logging system? | Refer to recently issued Logging policy per the Cyber EO as guidance, which is posted at: https://www.whitehouse.gov/omb/information-for-agencies/memoranda/ |
| 27 | Are you looking for a connected and disconnected EDR Solution (i.e. air gapped capable) | Each Agency and thier selection criteria are different. Other than federal-wide requirements that are legally mandated (e.g. FIPS), agencies unique envionrments and needs will drive these requirements. Refer to the program's functional baseline requirements (i.e. Volume 2) for CISA's "minimums". |
If there are use cases or examples of disconnected solutions that vendor's have experience implementing, please highlight (ie, OT network solutions).
| 28 | Are you also interested in XDR in addition to EDR? | See the published requirements in the RFI, the Government does not prescribe specific tools or market-definitions as a pretense for tool selection or validation. | |
| 29 | What are your plans for managing the solution long-term? In-house or managed offering? | The Government is looking for industry feedback on recommendations for how to manage the EDR program long-term as referenced by question 5 in the Information Requested section. | |
| 30 | In-regards to question number 1 and the current status; without specific disclosures, will this be a new Cloud adherent requirement to take the place of an On-premises or Hybrid deployment? | Each Agency and thier selection criteria are different. Other than federal-wide requirements that are legally mandated (e.g. FIPS), agencies unique envionrments and needs will drive these requirements. Refer to the program's functional baseline requirements (i.e. Volume 2) for CISA's "minimums". | |
| 31 | In-regards to question number 6, does the requirement require supplementation of Security Operation Center (SOC) duties? | Please refer to question 24 response. | |
| 32 | In-regards to Questions 10; will Integration be needed with the current environment or need to be kept siloed. | The Government is requesting industry feedback on its EDR approach and welcomes recommendations on how to leverage potential EDR solutions/tools across the federal enterprise. | |
| 33 | Are you considering mobile devices (iOS, Android) to be included as endpoints for detection and remediation? | The Government is defining "endpoints" using the FISMA guidance posted: https://www.cisa.gov/federal-information-security-modernization-act. Mobile device inclusion is not a "must have", but are considered a "nice to have". | |
| 34 | Are you considering an EDR solution to discover the known and unknown assets? | The Government is requesting industry feedback on its EDR approach and welcomes recommendations on how to leverage potential EDR solutions/tools across the federal enterprise. | |
| 35 | Are you considering an EDR solution to discover the assets on and off network? | The Government is requesting industry feedback on its EDR approach and welcomes recommendations on how to leverage potential EDR solutions/tools across the federal enterprise. | |
| 36 | Are you considering an EDR solution for local (on device) remediation? | The Government is requesting industry feedback on its EDR approach and welcomes recommendations on how to leverage potential EDR solutions/tools across the federal enterprise. | |
| 37 | Are you considering a hybrid on-prem/cloud solution? | The Government is requesting industry feedback on its EDR approach and welcomes recommendations on how to leverage potential EDR solutions/tools across the federal enterprise. | |
| 38 | Are you considering Vulnerability Risk Rating as an important capability for an EDR solution? | Please refer to question 24 response. Vulnerability detection and risk rating is viewed as a "nice to have" for the EDR capability, but not a "must have". | |
| 39 | Are you considering prioritizing patches to the endpoint devices based on criticality? | Please refer to question 24 response. Patch management is viewed as a "nice to have" for the EDR capability, but not a "must have". | |
| 40 | Are you considering providing kernel-level protection as part of the EDR solution? | Please refer to question 24 response. The Government is requesting industry feedback on its EDR approach and welcomes recommendations on how to leverage potential EDR solutions/tools across the federal enterprise. | |
| 41 | Are you considering preventing unauthorized transfer of applications and data by controlling access to input and output devices as in scope for this RFI? | Please refer to question 24 response. The Government is requesting industry feedback on its EDR approach and welcomes recommendations on how to leverage potential EDR solutions/tools across the federal enterprise. | |
| 42 | Are you considering micro-segmentation as an EDR solution capability? | Please refer to question 24 response. Micro-segmentation is viewed as a "nice to have" for the EDR capability, but not a "must have". | |
| 43 | Are you considering implementing a windows privilege management solution with a least privilege approach as in scope for this RFI? | Please refer to question 24 response. The Government is requesting industry feedback on its EDR approach and welcomes recommendations on how to leverage potential EDR solutions/tools across the federal enterprise. | |
| 44 | Are you considering preventing users accessing certain websites? | The Government welcomes feedback on the functional requirements for EDR, including user access to certain websites based on industry experience and recommendations. | |
| 45 | Is CISA using any existing threat intelligence services that the EDR should integrate with? If so, can you please specify them? | Each Agency and thier selection criteria are different. Other than federal-wide requirements that are legally mandated (e.g. FIPS), agencies unique envionrments and needs will drive these requirements. Refer to the program's functional baseline requirements (i.e. Volume 2) for CISA's "minimums". | |
| 46 | If the product is not currently on the CDM APL, will you consider it if it is “in process” or in the process of being added to the CDM APL? | Yes. Please indicate that your product is currently in process. However, this will not impact the review of the submission in meeting CDM requirements for the CDM APL. | |
| 47 | Has CISA considered the value of eXtended Detection and Response (XDR) collecting and correlating data across multiple security layers - email, endpoint, server, cloud, workload, and network? | Refer to response on question 28 | |
| 48 | Are you at liberty to share your market research review process or in other words what you will do with the RFI responses (e.g., GSA/CISA team review process)? Also, if this does become an RFP at some point when do you anticipate a release (FY2022, FY2023)? | The Government may consider additional communications with submitting companies utilizing the contact information provided in the Corporate Overview to further the Government’s market research for endpoint detection and response. This RFI is a form of market research the Government is currently conducting and any resulting acquisition strategy is under consideration. | |
| 49 | In your INFORMATION REQUESTED section, question #4, what do you mean by cost basis model? Are you looking for a pricing model that includes our GSA pricing? Does this include software and annual support/maintenance? Also, along with hosting/logging/dev, would you like to see our recommendations for EDR product implementation, professional services, training? | The Government is seeking information on pricing arrangements which can include but are not limited to software, maintenance, hosting, logging, retention, and APIs. and training. | |
| 50 | Will the market research gathered in this RFI be used to make any additional changes to the CDM technical volume II requirements for EDR? | The Government will consider RFI responses in the future development of EDR functional and technical requirements. | |
| 51 | Would GSA please consider a 5-page extension that allows additional space for graphics that better illustrate adherence to requirements? | Yes. A 5-page extension is granted. | |
| 52 | I am unable to locate an APFS record for this requirement. Has one been generated yet? | ||
| If not, when do you think one will be posted? | No. We are just conducting market research. |
| 53 | Is there a dollar range for this requirement? | No dollar range is identified. |
| 54 | Who is the DHS POC/Contracting Officer? | The current posting CO is David Shamburger. |
| 55 | Is there an incumbent? If so, please provide the Contract and or TO # and vendor name. | The purpose of this RFI is to assist the Government in conducting market research focused on gaining technical feedback from industry on tools and services that would provide sophisticated endpoint detection and response (EDR) capabilities for U.S.- based government organizations. This information will be used for market research only. The Government is not obligated to release a future solicitation based on this market research. |
| 56 | Is there any data that is in scope that needs to be protected and where is it expected to be found i.e.- laptop, desktop, or user share; etc. | Please refer to question 24 response. |
| 57 | Once data is captured at endpoint and leveraged in a stored tool, i.e.- Splunk is there a need for that data to be archived and/or analyzed after captured at the endpoint | Each Agency and thier selection criteria are different. Other than federal-wide requirements that are legally mandated (e.g. FIPS), agencies unique envionrments and needs will drive these requirements. Refer to the program's functional baseline requirements (i.e. Volume 2) for CISA's "minimums". |
| 58 | What is the expected footprint (amount of data) of the entire EDR system? | Each Agency's footprint and environment are different. The Government is looking to ensure that each tool can accomodate any individual FCEB agencies' scalability requirements should that tool be selected by the agency for any further consideration for procurement. |
| 59 | Is this a new system? If so, will the system itself need to be protected? | This builds upon current EDR capabilities at Agencies. |
| 60 | Is there a current data protection solution already in place that would extend its coverage to the EDR system? | Each Agency's footprint and environment are different. CISA does not operate the data protection solutions and architectures at the agencies. |
File details come from the government source that posted it. Updated .