RFI_CUI Security Operations Services_QandA_5.13.22.xlsx

XLSX spreadsheet 83 KB Posted May 16, 2022

Attached to: CISA Security Operations Services
Solicitation number: 47QFRA22K0018
Issued by: General Services Administration Federal Acquisition Service Assisted Acquisition Services Region 8

View the file

Other files

File	Type	Posted
CISA Security Operations Services RFI 4.27.22.docx	DOCX document	Apr 28, 2022
CB Security Operations Services RFI final 4.14.22.docx	DOCX document	Apr 14, 2022

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

SOS RFI Q&A

Question No. QUESTION RESPONSE

1 How many Linux instances are in your operating environment? The operating environment will depend on the number and type of participants. There is a high liklihood that a solution may be tailored to suit individual Agencies and entities with varying architectures, operating systems and maturity. As such, there is no definitive number for end points or specific environments to provide at this time.

Industry partners may make assumptions about the breadth, scale and maturity of the Participating Federal Civilian Executive Branch (FCEB) entities in order to describe their inherent capabilities.

2 If you run a virtualized environment, what is the maximum number of virtual machines running at the same time? The operating environmentwill depend on the number and type of participants. There is a high liklihood that a solution may be tailored to suit individual Agencies and entities with varying architectures and operating systems. As such, there is no definitive numbers for end points or specific environments to provide at this time.

3	How are you currently protecting your Linux environments?	See above. Additionally, the operating environment will be predicated on a variety of participating agencies. Responders are encouraged to make assumptions on or point to previous Federal experience with different architectures and tools.
4	What distributions of Linux and versions are you running?	The operating environment will depend on the number and type of participants. There is a high liklihood that a solution may be tailored to suit individual Agencies and entities with varying architectures and operating systems. As such, there is no definitive numbers for end points or specific environments to provide at this time.

Industry partners may make assumptions about the breadth, scale and maturity of the Participating FCEB entities in order to describe their inherent capabilities. For example, responders can show a range of infrastructure scale to display capabilities supporting various virtual environments 5 What types of workloads are you running on Linux? The operating environment will depend on the number and type of participants. There is a high liklihood that a solution may be tailored to suit individual Agencies and entities with varying architectures and operating systems. As such, there is no definitive numbers for end points or specific environments to provide at this time.

6	Where do Ransomware, Wiperware, Cryptojacking, MFA, Insider Threat and Unauthorized Data exfiltration rank in your list of top cyber security concerns?	The threat landscape is dynamic and always changing. CISA takes a holistic view to cybersecurity and currently recommends organizations—regardless of size—adopt a heightened posture when it comes to cybersecurity and protecting their most critical assets. More information can be found at https://www.cisa.gov/shields-up.
7	How important is efficacy to you (i.e., true positive rate)?	The requirements, specifications and derived performance parameters are still being developed. The government welcomes feedback and recommendations along these lines.
8	Would you prefer a cybersecurity solution that is twice as effective at detecting and stopping ransomware?	The requirements, specifications and derived performance parameters are still being developed. The government welcomes feedback and recommendations along these lines.
9	Would you prefer a cybersecurity solution that is three times as effective at detecting and stopping cryptojacking?	The requirements, specifications and derived performance parameters are still being developed. The government welcomes feedback and recommendations along these lines.
10	Is lower CPU overhead of cybersecurity solutions of value to the CISA?	CISA encourages a resource efficient solution to large scale challenges. As solutions will vary across the Federal Enterprise, vendors should respond reflecting cost/infrastructure considerations in their capabilities (ie, resource differentials associated with various solutions).
11	Are any evaluation criteria related to cost savings as a result of lower CPU overhead of a given cybersecurity solution?	CISA encourages a resource efficient solution to large scale challenges, but these approaches will vary by participating agency. Vendors are encouraged to highlight assumptions that will clearly depict their ineherent capability and/or make recommendations to the government for cost saving measures.
12	Would you prefer a cybersecurity solution that uses 95% less CPU cycles?	CISA encourages a resource efficient solution to large scale challenges. As solutions will vary across the Federal Enterprise, vendors should respond reflecting cost/infrastructure considerations in their capabilities.
13	How important is sustainability to you?	The requirements, specifications and derived performance parameters are still being developed. While sustainability is important to CISA, vendors should assume this is inherent in their approach
14	Would you prefer a cybersecurity solution that produces 95% less carbon?	The requirements, specifications and derived performance parameters are still being developed. While resource efficieny is important to CISA, vendors should assume this is inherent in their approach
15	How important is it to have a cybersecurity solution that is easy to install and supports automated updates?	The Government routinely considers ease of use a value-add as part of any capability.
16	Do you run exclusively in AWS GovCloud? If not, could you please describe your cloud environment (e.g. air-gapped environment, private cloud)?	The operating environment will depend on the number and type of participants. There is a high liklihood that a solution may be tailored to suit individual Agencies and entities with varying architectures and operating systems. As such, there is no definitive numbers for end points or specific environments to provide at this time.

Industry partners may make assumptions about the breadth, scale and maturity of the Participating FCEB entities in order to describe their inherent capabilities. For example, responders can show a range of infrastructure scale to display capabilities supporting various virtual environments 17 Would you prefer a solution that is twice as effective at detecting and stopping wiperware than current commercial solutions? The operating environment will depend on the number and type of participants. There is a high liklihood that a solution may be tailored to suit individual Agencies and entities with varying architectures and operating systems. As such, there is no definitive numbers for end points or specific environments to provide at this time.

Industry partners may make assumptions about the breadth, scale and maturity of the Participating FCEB entities in order to describe their inherent capabilities. For example, responders can show a range of infrastructure scale to display capabilities supporting various virtual environments 18 Would you prefer a solution that is twice as effective at detecting and stopping ransomware than current commercial solutions? The operating environment will depend on the number and type of participants. There is a high liklihood that a solution may be tailored to suit individual Agencies and entities with varying architectures and operating systems. As such, there is no definitive numbers for end points or specific environments to provide at this time.

Industry partners may make assumptions about the breadth, scale and maturity of the Participating FCEB entities in order to describe their inherent capabilities. For example, responders can show a range of infrastructure scale to display capabilities supporting various virtual environments 19 Which NIST Core Framework Function is most essential? While the requirements, specifications and derived performance parameters are still being developed, vendors should reference the FIBF framework for SOCs (https://ussm.gsa.gov/fibf-cyb-soc/) and the NIST functions and sub-activities identified. The government welcomes feedback and recommendations along these lines.

20 What container management system do you use? The operating environment will depend on the number and type of participants. There is a high liklihood that a solution may be tailored to suit individual Agencies and entities with varying architectures and operating systems. As such, there is no definitive numbers for end points or specific environments to provide at this time.

Industry partners may make assumptions about the breadth, scale and maturity of the Participating FCEB entities in order to describe their inherent capabilities. For example, responders can show a range of infrastructure scale to display capabilities supporting various virtual environments 21 Do you use containers provided by Platform One or Iron Bank? The operating environment will depend on the number and type of participants. There is a high liklihood that a solution may be tailored to suit individual Agencies and entities with varying architectures and operating systems. As such, there is no definitive numbers for end points or specific environments to provide at this time.

Industry partners may make assumptions about the breadth, scale and maturity of the Participating FCEB entities in order to describe their inherent capabilities. For example, responders can show a range of infrastructure scale to display capabilities supporting various virtual environments 22 Is automation important to your cybersecurity response? The operating environment will depend on the number and type of participants. There is a high liklihood that a solution may be tailored to suit individual Agencies and entities with varying architectures and operating systems. As such, there is no definitive numbers for end points or specific environments to provide at this time.

23	If you have an attack, what is the average time for remediation?	This type of specification will be dependent on the Agency consuming the commercial services.
24	Do you currently used a signature-based solution?	The operating environment will depend on the number and type of participants. There is a high liklihood that a solution may be tailored to suit individual Agencies and entities with varying architectures and operating systems. As such, there is no definitive numbers for end points or specific environments to provide at this time.

25	Do you understand the limits of a signature-based cyber solution?	The requirements, specifications and derived performance parameters are still being developed. The government welcomes feedback and recommendations along these lines.
26	If you are attacked, what is the average detection time?	The requirements, specifications and derived performance parameters are still being developed. The government welcomes feedback and recommendations along these lines.
27	Can you quantify the false positive rate?	This type of specification will be dependent on the Agency consuming the commercial services.
28	Can you quantify man hours spent investigating false positives?	This type of specification will be dependent on the Agency consuming the commercial services.
29	How does DHS CISA plan to deploy AI and ML?	The requirements, specifications and derived performance parameters are still being developed. The government welcomes feedback and recommendations along these lines.
30	What is the breakdown of your environment by operating system (e.g., % Windows, % Mac, % Linux)?	The operating environment will depend on the number and type of participants. There is a high liklihood that a solution may be tailored to suit individual Agencies and entities with varying architectures and operating systems. As such, there is no definitive numbers for end points or specific environments to provide at this time.

31	Are self-protection capabilities within the cybersecurity solution important to you?	The requirements, specifications and derived performance parameters are still being developed. The government welcomes feedback and recommendations along these lines.
32	Are formal programing techniques (i.e. proof-based techniques) important to the DHS CISA?	The requirements, specifications and derived performance parameters are still being developed. The government welcomes feedback and recommendations along these lines.
33	How important is implementing Zero Trust within the organization?	This is a priority for CISA. Vendors should refer to the May 2021 Executive Order (EO.14028) for more details.
34	Does DHS CISA have the flexibility for other government contract vehicles such as SBIR Phase III or OTA?	CISA has flexibility to execute Phase 3 SBIRs based on existing/previous S&T investments (ie, related Phase 1 and 2). CISA can utilize OTA for certain capabilities. The scale of services being considered may not align to OTAs.
35	Are companies that are in the process in applying for GSA MAS program still eligible for this opportunity?	Yes. The Government is currently conducting market research and an acquisition strategy is not finalized.
36	Would DHS CISA be hosting an industry in the near future?	CISA may elect to host an Industry Day as requirements are finalized.
37	What is the hierarchical level of CB vs CISA's Agile Cybersecurity Technology Solutions (ACTS)?	The organizational chart and functional alignment of this program is not pertinent to this RFI.
38	What DOJ offerings currently offered in partnership with CISA will be maintained as primary services?	CISA's QSMO Marketplace doesn't identify offered services as primary or ancillary solutions. The expectation is this requirement should have no impact on DOJ services offered within the QSMO Marketplace, but would provide federal agencies additional commerical options for services and solutions they can select from.

39 Does the Government have a preference as to any collected log sources as part of the Cyber Executive Order 14028? CISA adheres to the EO requirements for logging data/events. Any specific logging solution will be identified within an agreement between the Agency and provider. The government welcomes feedback and recommendations along these lines.

40 Are there any preferred federal agencies that may require additional logging support? CISA adheres to the EO requirements for logging data/events. Any specific logging solution will be identified within an agreement between the Agency and provider. The government welcomes feedback and recommendations along these lines.

41 Is the government's intent through this procurement to acquire a fully managed Security Operations Center (SOC)? Yes, the intent is to provide federal agencies the flexibility to procure a fully managed SOC solution or select from a suite of services that best fit their individual needs.

42 As an alternative to a fully managed SOC, would the government consider an 'a la carte' model that enables FCEBs to select the services (e.g., Staff, Tech, co-managed, or fully managed) that best fit their needs? Yes

The intent is to provide federal agencies the flexibility to procure a fully managed SOC solution or select from a suite of services that best fit their individual needs.

43	Would participating agencies need access to the collected data for this effort?	Yes. Predicated on Agency need and capacity to meet infrastrucutre resource load.
44	Is any type of clearance required to perform services with the agency? If so what type of clearance is required?	While the requirements and specifications are still being developed, the expectation is that there MAY be a need to access classified information as needed by the Agency and specified in their agreements.

File details come from the government source that posted it. Updated May 16, 2022.