RFI QandA_RFI Notice ID 47QFRA22K0006 Layer B.xlsx
XLSX spreadsheet 85 KB Posted
- Attached to
- Layer B Modernization
- Solicitation number
- 47QFRA22K0006
View the file
Other files
| File | Type | Posted |
|---|---|---|
| RFI QandA_RFI Notice ID 47QFRA22K0006 Layer B.xlsx | XLSX spreadsheet | |
| 47QFRA22K0006_RFI Layer B CDM_UPDATED 12.17.21.pdf | ||
| 47QFRA22K0006_RFI_Layer B CDM.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Layer B RFI
| Question | Section Ref. | Response | |
| 1 | Can the government share the current CDM Layer B solutions including tools and architecture designs of different CDM DEFND Groups with the contractors? | General | No additional information on the current in production Layer B Solutions will be released at this time. |
| 2 | Is “EXPERIENCE/CORPORATE CAPABILITIES” part of the Contractor Information Page or the part of the 10 pages limit? | Contractor Notification | The experience/corporate capabilities section of the RFI is part of the 10 page limit requirement. |
| 3 | What is the daily size of data consumed for each CDM DEFND group and what is over all data size retained in layer B for each CDM DEFEND group? | INFORMATION REQUESTED: 4 | Agency size varies significantly but understanding an upper threshold/limit is reflected in the largest of agencies who participate in CDM. A large agency could ingest/consume ~34GB/daily. As CDM datasets grow and agencies also expand data volumes could increase. |
| 4 | Please confirm the latest requirements for Layer B (any changes to CDM Tech Cap Vol Two Req Catalog v2.2 2020)? | INFORMATION REQUESTED: 4a | The CDM Technical Capabilities Volume Two: Requirements Catalog currently does not include requirements for Layer B. The requirements or needs are as written in the RFI. |
| 5 | Is the government looking for COTS, GOTS, or a combo of COTS and GOTS tools? | INFORMATION REQUESTED: 4a | No additional information available at this time. The purpose of the RFI is to gain technical feedback from industry. Thus respondents are welcome to provide recommendations that could included COTS, GOTS, or a combination of COTS and GOTS tools. However, long term sustainability and maintenance are strong considerations to ensure operational adoption of any solution. |
| 6 | Has the government standardized subordinate Layer A tools? Are all Layer A tools COTS? | INFORMATION REQUESTED: 5a | Layer-A tools are COTS, no standardization exists. The RFI indicates the need for the Layer-B solution to be highly adaptable for this very reason. |
| 7 | Will the Government please clarify if the Experience/Corporate Capabilities is included in the 10-page limit? | Contractor Notification Page 5 | The experience/corporate capabilities section of the RFI is part of the 10 page limit requirement. |
| 8 | Will the Government allow a smaller size font for tables and graphics? | Contractor Notification Page 6 | No adjustment to font requirement of the RFI is expected. |
| 9 | Will the Government please verify that the Cover page, TOC, and List of Exhibits are excluded from the 10-page limit? | Contractor Notification Page 7 | Any title page, table of contents or list of exhibits will not be considered as part of the 10 page limitation. |
| 10 | Is this question meant to request best practices in documentation of interfaces or best practices in establishing interfaces? | Information Requested; Question 3 Page 4 | This question is specifically in regards the to the documentation to facilitate proper knowledge and change management processes as the CDM architecture evolves and remains flexible to continuous tool substitutions and data requirements adjustments at Layer-C (CDM Dashboard). How the physical interfaces are developed and established, including the best practice recommendations, are in scope for this RFI as well, implied in Q1, Q4, Q6, Q8, et. al. |
| 11 | Will the government permit smaller font sizes in graphics and tables to demonstrate key concepts, provided the content remains legible? | Contractor Notification; Page 5 | No adjustment to font requirement of the RFI is expected. |
| 12 | Would the Government please add a third question/line item to the Experience / Corporate Capabilities section of the response to allow vendors to provide suggestions and recommendations for the acquisition strategy? | Experience/Corporate Capabilities Page 3-4 | No additional information around acquisition strategy is requested. Respondents are welcome to identify any existing Government contract vehicle (GWAC, Federal Supply Schedules, BPA, etc.) could support Layer B in question 2 of the Experience/Corporate Capabilities section. |
| 13 | Please provide an estimate of roughly how many Events Per Second (EPS) do the 1 – 3 million endpoints generate? | This information is not readily available, please see the question regarding approximate daily data size for additional insight into technical load on layer-b. (Question 3) | |
| 14 | Please provide the percentages of device types contained within the 1 – 3 million count (network, servers, endpoint: workstation, laptop, mobile)? | The vast majority of assets are endpoints (e.g. Servers, Workstations, Desktops, Laptops), representing 75%+ of the enterprise as a rough average. | |
| 15 | Do the endpoints directly send logs or are the logs aggregated through an endpoint solution such as A/V? | This is dependent on the specific tools in place, both instances are in place. | |
| 16 | What specific data format does the collection system accept: syslog, Common Event Format (CEF), other? | There is no data standard and the Layer-B solution must support a multitude of different standards, protocols, etc. due to the problem statement in the RFI (Layer-A is de-normalized, contains an aggregate of different industry tools and capabilities). Layer-B isn't a SIEM tool by its natural function, it is a data aggregator with ETL functionality to support CDM Data Requirements. | |
| 17 | What data types and formats are currently in use? (As transformation of binary and other data types can require a good amount of development in order to provide a normalized dataset.) | Cyber Hygiene data (Vulnerabilities, Hardware and Software inventories, etc.) and event logs (Linux/Windows Event logs, etc.) are expected. Formats can very depending on tools, but include CSV, XML, JSON. The normalized schema employed at Layer-C is very similar to the Elastic Common Schema (ECS). | |
| 18 | Is the data requiring integrations structured, unstructured or both and what formats are in use? | There is no data standard and the Layer-B solution must support a multitude of different standards, protocols, etc. due to the problem statement in the RFI (Layer-A is de-normalized, contains an aggregate of different industry tools and capabilities). Layer-B isn't a SIEM tool by its natural function, it is a data aggregator with ETL functionality to support CDM Data Requirements. | |
| 19 | Is there a rough estimate available regarding data size give 3 million endpoints? | Agency size varies significantly but understanding an upper threshold/limit is reflected in the largest of agencies who participate in CDM. A large agency could ingest/consume ~34GB/daily. As CDM datasets grow and agencies also expand data volumes could increase. | |
| 20 | Will applications that utilize the data in its native format require changes based on ETL (Extract, Transform, and Load) process? | This is not anticipated other than changes on the applications to feed the ETL process. | |
| 21 | If data collection is in phases – what type of data is collected and when? What is the timeline? | Currently the program is focused on Cyber Hygiene data (Vulnerabilities, Endpoint configuration data, hardware and software inventories), with additional datasets expected over the next two years to include security events from popular data sources such as IDS / IPS / Firewalls, windows and Linux security logs. | |
| 22 | Assuming currently data is not real-time, how long is the delay from real time currently? | The objective is to have data from authoritative sources into the CDM Dashboard (layer c, as supported by layer-b ETL processing) to be no older than (minimally, but greater currency is desirable) 72 hours from the date/time it was received by that authoritative source. For example, if a vulnerability sensor detects and reports a vulnerability on day X, the data pipeline (including Layer B, ETL processing) should have the normalized, required data into the CDM Dashboard (Elastic Stack) no later than day X + 72 hours. | |
| 23 | The RFI states that the purpose of the RFI is to obtain recommendations regarding a "…single integration layer (Layer B) solution for the Continuous Diagnostics and Mitigation (CDM) Program". Please clarify the term "single integration layer (Layer B) solution". Is this one instance of an integration layer solution that will accept data from all CDM-participating agencies? Is this one standard architecture that can be deployed across multiple CDM-participating agencies? | RFI Objective Page 1 | The government is open to architectural recommendations, but the current design for large FCEB agencies is for each to employ their own platform. The CDM PMO views standardized architecture and designs as a favorable for creating O&M synergy. Standardized architectures can include, but is not limited to, a single deployment/instance or multiple deployments/instances based on a common design. Recommendations for both (if viable) is recommended given the governance ramifications for FCEB datasets. |
| 24 | The RFI states "The solution must…integrate data…within a federated agency." Is there a requirement that the agency will be able to view data in the Integration Layer Solution? If so, is there a segmentation requirement related to the agency's federated organizational structure? | Requirement Objectives Page 3 | The fundamental requirement for the CDM Integration layer is to provide normalization, correlation, and other relevant transformations to ensure the CDM Dashboard receives timely, clean, accurate, complete datasets. Direct end user access and interaction with the integration layer is not a fundamental requirement. The CDM Dashboard is intended to satisfy any operational user interaction (primary UI) with the collated datasets from the program. Segmentation of the data in transit isn't a known constraint today. |
| 25 | The RFI states "CISA also requests information on factors where integration between the tool and Agency Dashboard level may not be the best option". It is unclear what other option would be available, or why integration would be undesirable. Won't all tool data have to flow through some type of Data Integration Layer before reaching a CDM Agency Dashboard? If not, can you provide an example that would not? | Information Requested Page 4 | Yes. Data that doesn't need to be normalized or structured before inserting (e.g. Schema on Read). Another example could be cases where data can be extracted from authoritative sources (e.g. endpoints) already normalized based upon the integration strategy (e.g. agent extracting or normalizing data before sending to Dashboard). |
| 26 | The RFI asks about "What is the processing power…to get real time or near real time data?" Can you clarify the requirement for data to be available real or near real time? For example, are the data to be displayed in real or near real time in the integration layer, the CDM agency dashboard, and the CDM federal dashboard? | Information Requested Page 4 | Yes. Please see the response for question 22 for more information. |
| 27 | The RFI requests "recommended technical performance standards". Are the requirements for data currency the same as currently exist for CDM? | Information Requested Page 5 | Yes. Please see the response for question 22 for more information. |
| 28 | The RFI requests "recommended technical performance standards". Are there any data retention requirements? | Information Requested Page 5 | Recommendations from industry are encouraged to help identify best-practices for data retention (e.g. optimal cost/benefit points for an ETL solution). To reiterate the intended purpose of this sub-system: The ETL layer (i.e. CDM Layer-B) is not an authoritative repository of data for supporting long term retention use cases (e.g. forensics, incident detection, discovery), but rather who's primary focus is to feed a CDM Dashboard (Elastic Stack) complete, accurate, and timely CDM data. |
| 29 | The RFI states "Response to questions should be no longer than 10 pages." Does the 10 page limitation apply per question? | Contractor Notification Page 5 | No. Responses to all of the questions in the Experience/Corporate Capabilities Section and Information Requested section shall not be longer than 10 pages in total. |
File details come from the government source that posted it. Updated .