Request for Information_Protective Email Service_GSA Ref 47QFRA22K0005_QandA.xlsx

PES RFI Q&A

Question No. QUESTION RESPONSE

MX handling is envisioned to be PES solution dependent. As stated in the RFI, CISA is seeking solutions that protect FCEB email and will consider concepts such as those described in the question as well as hybrid solutions that use multiple enforcement points.

Yes. However, solution implementation is still to be determined and the Government is seeking input on deployment considerations.

CISA Global Operators need the ability to conduct in depth hunting and incident response missions across FCEB. Specific query methods are solution dependent. RFI respondents may include any related, relevant operational considerations as part of the RFI response. RFI respondents should refer to existing cybersecurity executive orders as background material to reference relevant policies.

16 What email providers will be in scope?

PES intends to address all FCEB email traffic. RFI respondents should present solutions that most effectively address this intent, and explain any envisioned coverage gaps.

Question: When deployed inline, is the intention for the PES system to sit as the MX record and

Question: Can CISA provide more details around the API services and intended integrations?

Question: Does CISA intend to use the Global Operator Access API for configuration changes,

Question: Can CISA elaborate on the CISA indicators? Approximately, how many indicators need to be in the system at any given time and what type of indicators?

RFI respondents should consider indicators such as those commonly used by security operators in any large organization, and note that CISA tracks a large number of threat indicators that can be applied to the cyber-domain. CISA envisions that the solution's architecture would have the capability to scale.

23 Reference: Page 3, Scalability, FCEB Agency Size Question: When deployed inline, does CISA intend for all 100 agencies to leverage the same cloud infrastructure or would CISA require a separate cloud infrastructure for each agency?

RFI respondents should offer recommendations that address this question; CISA does not have an approved PES solution architecture at this time.

24 Reference: Page 4, Email Protection Services, Email Protection Service Roles Question: Can CISA elaborate on the access needed for the FCEB administrator? What is the primary function of these administrators, will they have the ability to create policies and rules? Will the administrator for FCEB agency A be able to view rules that pertain specifically to other FCEB agencies? Will the FCEB administrator view Global CISA policies?

CISA intends to minimize the impact to FCEB agencies, to include FCEB administrators. CISA understands that a balance must exist such that CISA Global Operators and FCEB administrators are both able to perform their respective misssions. However, RFI respondents may include any related, relevant operational considerations as part of the RFI response.

25 Reference: Page 4, Data Access, Email Data Access Question: Does CISA intend to store internal agency email for 1 – 2 years? Approximately, how many messages and what is the average message size for all emails that need to be stored?

Question: Does CISA intend to import previously archived messages for the FCEB agencies? If so, what is the size of the import?

This level of detail has not been defined. RFI respondents may address this and provided recommendations in RFI responses.

27 Reference 1: NAICS CODE Question 1: As per the Sources Sought on Sam.gov, the NAICS code referenced is 541330 Engineering Services, small business. To allow for as much competition as possible but still allow a small business set-aside, it is recommended to consider 541519 Computer Related Services and allow exception note 18 for 150 employee size standard. This will allow various small business contractors and Best in Class contract options such as GSA Schedule, CIO-CS or SEWP V which benefits CISA. This will allow small business solution providers who sell COTS products that meet CISA requirements to provide a proposal and ensure sufficient competition and competitive solutions.

Question: Can CISA elaborate on the CISA proprietary threat intelligence feeds? What format are these feeds provided in? What types of indicators are present in these feeds? How often are the

Question 1.a: Should the data be expected to be shared with other CISA data sources for correlation?

Question 1.b: Will CISA be looking to collocate this data with other systems?

Will agencies be required to leverage this service?

The intent is to ensure PES capability protects all FCEB email traffic.

34 IV. OVERVIEW OF SECURITY OPERATIONS SERVICES CAPABILITIES

Regarding Sandbox, is sandboxing of email attachments allowed on the Vendor Cloud or does CISA require sandboxing in a CISA or Agency-specific datacenter?

Specific operational considerations will be solution dependent. Respondents may address this as an assumption and/or provide recommendations in RFI responses.

35 IV. OVERVIEW OF SECURITY OPERATIONS SERVICES CAPABILITIES

Is there an expected SLA for email delivery or other system accesses by CISA or Agency administrators?

This level of detail has not been defined beyond the general concept of minimizing impact to FCEB operations. RFI respondents may address this and provide recommendations in RFI responses.

36 IV. OVERVIEW OF SECURITY OPERATIONS SERVICES CAPABILITIES

Will agencies continue to leverage their own PES, in addition to this common service? If so, will this service be the first hop or second hop in the email pipeline (being second hop will minimize insights due to filtering already done in first PES hop)?

Would this capability augment or replace current E3A services?

Will each agency define their own policy rules (e.g., filters, DLP, scanning) or will there be central governance to decide on common rules across agencies?

CISA understands that both CISA policy (e.g., CISA developed indicators), which is expected to be mandatory, and Agency policy (e.g., Agency DLP rules) must be supported by the PES capability. RFI respondents may offer recommendations on how this can best be accomplished. (note: CISA will also allow for list-exceptions for Agencies)

39 IV. OVERVIEW OF SECURITY OPERATIONS SERVICES CAPABILITIES

Regarding Email Data Access, is the PEX expected to archive emails for long-term storage or will this be an agency responsibility? If Agency responsiblity, is PES expected to retain email logs for long-term storage?

Federal data retention requirements (specifically for email) will be considered as part of and future PES activities. RFI respondents may offer recommendations on how this can best be accomplished.

40 IV. OVERVIEW OF SECURITY OPERATIONS SERVICES CAPABILITIES

Regarding Advanced Protection, is the PES expected to use specific External Threat Feeds? If so, are they in STIX format from a TAXII server?

Regarading Email Compromise and Data Loss Prevention, is the DLP only for email textual content or does it extend to attachments?

Ideally, DLP capabilities will include attachments but as the question states industry may offer specific DLP solution recommendations in the RFI response as desired.

42 VI. RFI RESPONSE, Question 2 Is FEDRamp required now or is the goal to be FedRamp prior to service going operational?

When and if will FEDRamp be required? Will a phased approach be used?

How does CISA envision the PES capability being integrated with other shared cyber security solutions (e.g., PDMS)?

Would the government consider increasing the response to questions (Section 2) to be no longer than fourteen (14) pages in length?

PES RFI Compliance