RFI 47QFRA23K0002 CISA CSD CB Threat Intelligence Enterprise Services (TIES) QA 12.7.22.pdf

Question No. Question Response

1 How are these services currently performed (in house, contractor)? If by a contractor, please provide:

Contractor Name:

Contract #:

Task Order # (if applicable):

This is a new capability development effort to establish a Federal Enterprise solution for bi-directional CTI sharing. There is no Federal Enterprise platform solution in place that is managed by CISA or its Divisions/Subdivisions. Currently, CISA offers access to a number commercial threat feeds as part of disparate enterprise license agreement(s)

2 If there is not an incumbent, what is the estimated dollar value range for this requirement? This RFI is for market research and requirements refinement purposes. The governement is still in the process of finalizing detailed requirements and characteristics for this service offering. Should the government move forward with an acquisition, it is critical that we recieve a best value soultion. As such, insight into commercial pricing, SKUs, licensing agreeemnts, etc would assist the government in assessing the viability of this program. 3 Who is the Contracting Officer? This requirement is still in very early planning stages and no Contracting Officer is assigned to any acquisition related to this notice to date.

4 Is there an APFS record associated with this requirement? If so, please provide the APFS #. If not, when will an APFS record be posted.

No, the RFI is for market research purposes only and does not constitute a RFP. Acquisition information will be made available when ready.

5 During my review of the requirements, I noticed the numbering under "Architecture", found at the bottom of page 5, is a mistake. It shows "13" for the question listed. Should it be "14"? If yes, the remaining sections will need to be renumbered.

The RFI has been updated to reflect the change.

6 Is the government looking for a COTS tool for this solution, or are you open to a custom-built application?

The government is looking for a comprehensive enterprise solution. The solution may be either a COTS tool, a COTS tool with some customization or a custom-built application, provided the solution meets the government's requirements. The overall requirements are still under development.

7 Is the proposed CTI Exchange Platform envisioned to be at the Unclassified level only? Yes. While the Exchange Platform will target the UNCLASS level, the government is interested in understanding capabilities to segment for Classified use.

8 Does the Government envision data from the CTI EP will also feed up to a classified system? Yes. While the Exchange Platform will target the UNCLASS level, the government is interested in understanding capabilities to segment for Classified use.

9 Will the Government be expecting that all levels of TLP 2.0 Data (Red, Amber, Green, Clear) be held in the CTI EP System?

Yes. The government expects the solution to accommodate all TLP markings.

10 Is CISA open to a commercially available platform that can share all versions of the STIX object types in an automated platform to platform manner, along with facilitating the traditional STIX/TAXII exchange?

The government is looking for a comprehensive enterprise solution and welcomes recommendations. The solution should accommodate a number of exchange methods and object types. Further insight into efficiencies and value-adds of any particular solution should be provided as part of the RFI response.

11 Under section IV. Operational and Functional Overview of TIES Solution:

“The solution must provide for the ingestion, tagging and correlation of multiple threat related data sets. The solution must support native data types for all STIX Domain Objects (SDOs), with the ability to index and query all SDOs.”

Question: Can you provide an example of how you would define tagging?

In addition to market research, the RFI responses will assist the government in refining functional and technical requirements. As such, CISA welcomes recommendations regarding of characteristics and functionality of the solution tagging capability. The solution should be flexible enough to iterate over time in terms of how the government will tag data. At a minimum, tagging should be understood to include (but not be limited to), source and analyst attribution, TLP, and threat context. Vendors can reference the OASIS CTI STIX website walkthrough example here: https://oasis-open.github.io/cti-documentation/stix/walkthrough on how to extract IOCs from cyber incident reporting by tagging them using the STIX SDO data types.

12 Please describe your current licensing model for similar capabilities, including examples of itemized bundles of licenses or product subscriptions.

How should CISA estimate data volume and cost for a long-term data warehouse that houses CTI data and makes it available on-demand for analysis? Are there any challenges that CISA should consider when estimating data volume and cost?

Question: How many data sources are estimated to be feeding the CTI platform?

The government is looking for a comprehesive enterprise solution and welcomes recommendations. Further insight into what comprises a comprehensive threat feed footprint would assist the governemnt in refining technical requirements for the TIES offering. The Government will be providing further information regarding intelligence data needs and characteristics in future requests for information. Additionally, the solution must be flexible to add threat feeds and data sources as the need arises.

13 What metrics exist about the use of and users of a threat intelligence solution, and how can those metrics be derived? Identify any recommended technical performance standards relevant to a threat intelligence solution.

Question: What is the intended use of or desired insight from the user metrics?

While this will be refined as technical requirements are finalized, the government expects user metrics to provide both operational platform insights (i.e., usage and performance metrics) as well as strategic threat trend metrics. The government desires visibility on how CTI is being utilized by consumers to help the collective participating agencies (both individually and collectively).

This will allow for improved cybersecurity decisions an integrations between the capability and other tools in consumer organizations' security toolstacks to enable detection, and investigation and response at machine speed. The government's belief is that this will significantly reduce mean time to detect (MTTD) and mean time to respond (MTTR) while simultaneously reducing analyst workload by automating aspects of data analysis and data operationalization. Ultimately, the government expects to see a reduction in certain threat activity at the organizational level and globally across the FCEB as users of the capability take recommended actions to respond to threat activity.

14 What are the different ways that tipping and queuing (automated or manual) can be implemented using a CTI solution? Of those approaches, which have you implemented, or would you implement, and why?

Question: Can you provide an example of what is meant by tipping and queuing?

For the purposes of this RFI, tipping/queuing allows for action to be taken by multiple systems/people/agencies based on actions detected by an initial system/agency. The government foresees at least two possible tipping/queuing models: 1) TIES-centric model, wherein the exchange platform receives/develops threat information, a TIES workflow generates a tip to FCEB partners, and receiving infrastructure in the FCEB partner enterprise (e.g., SOAR/workflow) receives the tip and executes actions based on the received information, and 2) an FCEB agency-centric model in which an FCEB partner detects threat activity and sends a tip to TIES with context, and the TIES exchange platform analyzes and distributes the tip to the entire FCEB ecosystem. A detailed example: the TIES exchange platform could "tip" users to an emerging threat event (for example, log4j exploitation of vulnerable devices) and "queue" their SOC, SOAR capabilities and SYSADMINs to monitor similar devices in their network for signs that the integrity of those devices may have been compromised. The government would welcome feedback from industry on other possible models/examples beyond those provided above.

15 I see there's an expectation that the data and API be accessible by third parties. Is there any requirement that the third parties also have access to the enrichment and correlation capabilities?

We envision that the solution will enable enrichment and correlation at the organization level, within the solution, using data shared via the solution (e.g., commercial and non-commercial threat feed data, user generated CTI) and data integrated from third party tools within the user's environment (e.g., SIEMs). We also envision that users will have the ability to leverage third party provided enrichment capabilities via tools that can exchange data with the solution via integrations. On the global level, we foresee enrichment and correlation capabilities, ex., AI and/or ML, being leveraged against aggregated data from the solution.

16 In addition, in regard to the CISA Partner Community Platforms, will those be the same platform as the one CTI Exchange platform? If not, do we know what platforms other communities will be utilizing?

The government does not have an exhaustive list of community platforms in use but CISA requires this solution to be interoperable with participating community solutions, platforms and other systems as the need arises.

17 Is there an expectation that third parties would also have access to the CTI exchange platform? If so, what level and type of access would be required?

The government expects this solution to accommodate a multi-tenancy structure. FCEB and community partner users are expected to have segmented access to various data layers that comprise the solution.

"Third party" Commercial Threat feeds will be integrated into the platform. As such, commerical CTI providers and other non-government entities are not expected to have access to this exchange platform.

18 Roughly, what is the expected number of users required to have direct access to the CISA CTI Exchange Platform?

The expectation is that this Exchange platform will cover an unlimited user base associated with government entities with the potential to uplift coverage for State and Local entities.

19 Are the CISA Partner Communities 1 and 2 the same as the AIS? Or are they members of the

AIS?

The high level architecture diagram was meant to provide context to responders. The Community Partners should be viewed as notional external participants with which the platform would bi-directionally exchange data.

20 Will CISA please define "network compliance" from the statement below?

"Common information required includes IoC management and history, network compliance , and TTPs observed in the sector."

The government is interested in gathering security policy information, specifically relating to how attacker behavior maps to weaknesses in infrastructure hardening, detection, protection and mitigation capabilities and, ultimately, security policy compliance.

The government is interested in the integration of cyber hygiene/vulnerability assessment data to correlate with threat intel, reports, etc. This integration will assist in identifying threats and exploits being carried out for a given entity, as well as to aid in prioritization of analytical efforts.

21 Will CISA please confirm whether it intends to mandate the use of the CB CTI Exchange platform across FCEB agencies? If mandated, will CISA continue to manage the service on behalf of agencies?

CISA intends to make this platform available to all federal executive branch agencies, and will strongly encourage collaboration within this environment

22 Will CISA please confirm that the requirement to use STIX/TAXII will be 2.1+ and not 1.0? CISA expects that platform will acommodate the latest CTI Data Standards available, including STIX, MISP, etc. At the time of this RFI, the government expects that vendors should, at minimum, be using STIX 2.0 and making preparations to use 2.1.

Please reference examples as provided by OASIS CTI STIX here: https://oasis-open.github.io/cti-documentation/stix/compare

23 Does CISA intend to use the TIES contract to purchase its commercial threat intelligence feeds or will those be purchased through a different contract vehicle?

The government is looking for a comprehensive enterprise solution and welcomes recommendations. Any insight into procurement efficiencies and value-adds should be provided as part of responses.

24 Will CISA please confirm whether attribute-based access control (ABAC) will be required in the platform?

The government is still refining overarching technical requirements to include access control processes and structures (ie, RBAC/ABAC/etc). CISA welcomes recommendations as it pertains to responder capabilities and features.

25 Does CISA intend to use the TIES contract to purchase its commercial threat intelligence feeds or will those be purchased through a different contract vehicle?

See above response to Question #23

26 On page 5 CISA asks, "How should CISA estimate data volume and cost for a long-term data warehouse that houses CTI data and makes it available on-demand for analysis?"

Please clarify the definition of long-term; is it 6-12 months, 3-5 years, or 10 years?

This can be defined by the responder, but as a reference an assumption can be made that long term storgage for CTI data is some period beyond 12 months.

27 On page 5 CISA asks, "How would you propose to address CISA-specific operational and technical platform needs and requirements separate from non-CISA users?"

Can you clarify, or provide examples of unique CISA operational and technical requirements?

Is the Contractor expected to provide training to FCEB, SLTT, and other stakeholders? If so, how many agency stakeholders is the Contractor expected to provide training to?

Platform operational and technical requirements for both CISA and its interagency partners are being refined by CISA. The government intends on accomodating "non-CISA user" platform needs and integrations that may differ from CISA's needs and integrations. At a high-level, the government is interested in how providers would accommodate those different sets of needs and requirements with the same exchange platform.

Regarding training, the government expects the platform vendor to provide basic user training associated with the platform and tool (ie, feature oriented learning). The training may evolve to a periodicity and/or cohort based offering. Howerver, the expectation is that user training may be significant as the platform initially ramps up into steady state use. It can be assumed that training would be conducted virtually.

28 What is the anticipated security classification of the effort? If UNCLASS, does the Government expect that some of the CTI instances in the future will be at a SECRET or TS classification level?

See above response to Question #8.

29 What are the mulit-level security (MLS) info sharing arrangements for the current collaboration environment? How does CISA envision MLS info sharing to evolve under the TIES effort?

The government welcomes feedback and insight on this capability. As CISA matures this solution, the government will ensure arrangements and capabilities are in place to cover integrations with various external partner systems and platforms. This would imply the need for processes and structures to permit bidirectional sharing of information between this capability and those partner systems and platforms, even if those other systems and platforms may have different security requirements than CISA does for this capability. The government expects that any partner systems and platforms will be federal systems and platforms.

30 Does the government intend to build and operate the CTI Exchange Platform, or buy a managed collaboration platform?

The government intends to use the results of the RFI to gain insight into this very questions. CISA welcomes feedback as to value-adds and efficiencies that would be realized through specific solution recommendations.

31 Does the Government expect a completely integrated commercial IT solution from a single vendor or a Systems Integrator to deliver best of breed solutions that meet functional and technical requirements?

The government intends to use the results of the RFI to gain insight into this very question. CISA welcomes feedback as to value-adds and efficiencies that would be realized through specific solution recommendations.

32 Is the initial requirements to have one (1) CTI instance to be assessed and validated for a proof of conept / Initial Operating Capability? Or will the requirement be for developing and deliveing multiple instances for assessment during a proof of concept / IOC phase?

The Government intends to acquire one instance of a CTI platform to meet initial requirements. The Government does not intend to conduct a platform proof of concept prior to contract award and ATO. This may include internal assessments, Independent Verification & Validation and/or testing of the platform.

33 Will the DevSecOps pipeline for applications and capabilities development be 1) solely government (pulling in industry apps) or 2) government/industry integrated environment?

The government assumes that the integrated environment would be the most efficient solution. However, CISA welcomes feedback as to value-adds of each approach as described by RFI responders.

34 What CTI information exchange tools does CISA use today? The government uses a number of exchange tools, including but not limited to: AIS, MISP, commerical threat intelligence platforms, email, common messaging applications.

35 What volume of existing and historical CTI data be required to be imported into the new CTI Platform?

The government intends to use the results of the RFI to gain insight into this very question. CISA welcomes feedback as to capacity considerations regarding the volume of CTI historical data.

36 What are the mulit-level security (MLS) info sharing arrangements for the current collaboration environment? How does CISA envision those MLS info sharing to evolve under the TIES effort?

The government welcomes feedback and insight on this capability. As CISA matures this solution, the government will ensure arrangements and capabilities are in place to cover integrations with various external partner systems and platforms. This would imply the need for processes and structures to permit bidirectional sharing of information between this capability and those partner systems and platforms, even if those other systems and platforms may have different security requirements than CISA does for this capability. CISA expects that any partner systems and platforms will be federal systems and platforms.

37 Is there an incumbent Prime Contractor or Technology Vendor currently performing on similar tasks?

See above response to Question #1.

38 Is the Governent planning on providing Tier 1 end user help desk support for the system, with the Contractor responsible for Tiers 2 and 3? Is Help Desk support required 24x7 or 5x8?

The government expects some semblence of professional support services and Help Desk support as part of this development and operational effort. The Government welcomes recomemndations.

39 What "email security services support" is the government interested? "Email security services support" does not apply to this RFI. However, the government would like insight into secure messaging functionality.

40 Will the government schedule an industry day for the CTI requirement? The information provided as response to this RFI will be used for market research only. The Government is not obligated to release a future solicitation based on this market research. If a follow-up meeting is required, the Government will reach out directly to the industry partner point of contact

41 What Acquisition Strategy(ies) is the Government considering? How do you envision leveraging existing and / or new vehicles adding into that strategy?

The information provided as response to this RFI will be used for market research only. The Government is not obligated to release a future solicitation based on this market research. The government welcomes insights based on unique structure of the resonder's recommended solution

42 Does the Government expect an evolution of the current STIX and TAXII standards in the proposed solution architecture?

The Government expects that platform will acommodate the current and future CTI Data Standards available, including STIX, MISP, etc.

43 Can CISA please define "long-term" for data retention? See response to question #26 above.

44 Does CISA anticipate the eventual CB CTI Exchange platform to be the product of one solution provider or a collaboration of industry partners?

The government welcomes insights based on unique structure of the responder's recommended solution.

45 "Common information required includes IoC management and history, network compliance, and TTPs observed in the sector." Can CISA please define Network Compliance as a requirement of the eventual TIES solution?

The government is interested in gathering security policy information, specifically relating to how attacker behavior maps to weaknesses in infrastructure hardening, detection, protection and mitigation capabilities and, ultimately, security policy compliance.

The government is interested in the integration of cyber hygiene/vulnerability assessment data to correlate with threat intel, reports, etc. to identify threats and exploits being carried out for a given entity, as well as to aid in prioritization of analytical efforts.

46 There's an expectation that the data and API be accessible by third parties. Is there any requirement that the third parties also have too have access to the enrichment and correlation of capabilities?

The government envision's that the solution will enable enrichment and correlation at the organization level, within the solution, using data shared via the solution (e.g., commercial and non-commercial threat feed data, user generated CTI) and data integrated from third party tools within the user's environment (e.g., SIEMs). The government also envision that users will have the ability to leverage third party provided enrichment capabilities via tools that can exchange data with the solution via integrations. On the global level, the government foresees enrichment and correlation capabilities, ex., AI and/or ML, being leveraged against aggregated data from the solution.

47 In regard to the CISA Partner Community Platforms, will those be the same platform the one CTI Exchange platform? If not, do we know what platforms other communities will be utilizing?

The high level architecture diagram was meant to provide context to responders. The Community Partners should be viewed as notional external participants with which the platform would bi-directionally exchange data.

48 Is there an expectation that third parties would also have access to the CTI exchange platform? If so, what level and type of access would be required?

The government expects that third party tools would have access to the platform (depending on customer need) via integrations at the level of the user organization. Such integrations include, but are not limited to, security tools (e.g., SIEMs, SOARs), communications platforms, collaboration tools, data feeds, visualizers, TIPs, etc.

The government also envisions that the solution will enable enrichment and correlation at the organization level, within the solution, using data shared via the solution (e.g., commercial and non-commercial threat feed data, user generated CTI) and data integrated from third party tools within the user's environment (e.g., SIEMs). The government also envisiosn that users will have the ability to leverage third party provided enrichment capabilities via tools that can exchange data with the solution via integrations. On the global level, the government foresees enrichment and correlation capabilities, e.g., AI and/or ML, being leveraged against aggregated data from the solution.

49 Roughly, what is the expected number of users required to have direct access to the CISA CTI Exchange Platform?

The expectation is that this exchange platform will cover an unlimited user base associated with government entities with the potential to uplift coverage for State and Local entities.

50 Will pDNS, CyberSentry, and CDM be included as a data feed? The government expects this platform to accommodate interoperability specs for various existing internal and external services and capabilties.51 Will all external feeds be provided by the gov as GFI – i.e. Crowdstrike, Mandiant, MSFT, etc…?The government welcomes recommendations for a comprehesive enterprise solution. Any insight into efficiencies and value-adds should be provided as part of responses.

52 Does CISA expect to integrate datasets from other CISA programs (e.g Threat Hunt, VM, CDM)?

The government expects this platform to accommodate interoperability specifications for various existing internal and external services and capabilties.

53 How does CISA expect .gov Departments and Agencies to consume CTI? API? TIP platform?

Alert Driven?

The government expects agencies to consume CTI, API, TIP, finished reports and Alerts as required by their individual mission needs. It should be assumed that the above list is not exhaustive and that RFI responses should consider this as part of their description.

54 Does CISA want Departments and Agencies to contribute data to the platform? Yes. The primary capability of this platform is bi-directional data sharing.

55 Will CISA expect the Departments and Agencies to participate in a cost sharing model? The future funding model should not impact responses to this RFI. While CISA may initially be funding this effort, CISA may consider alternative models as interagency needs evolve over time.

56 How is CISA/CB planning to fund TIES? See RFI response to Question #55 above.

57 Will the CTI Exchange be offered to .gov and partners free? Subscription Fee? See RFI response to Question #55 above.

58 Will .gov and partners be mandated to use TIES or will it be voluntary? At this time, participation and usage will be voluntary.

59 Has a specific vendor(or vendors) helped the Capacity Building team build the TIES RFI and/or notional architecture?

If so, would that particular group be precluded from becoming a sub-contractor on an RFP response team due to OCI?

The government leverages affiliated research labs to assist in developing reference architectures and technical requirements

60 Does CISA envision a significant role for small business within the CTI Exchange RFP? The Government always encourages small business participation and use market research conducted such as this RFI as information that would go into any acquisition approach.

61 The subject RFI indicates a 10-page response. Will a cover page be exempt from the 10-page limit?

Yes

62 The RFI makes reference to “Interested parties should respond to this RFI outlining their capabilities (as guided by the below comments/questions and the overview listed above)” but the format calls for a 1-page Section 1 with administrative information and a 9-page Section 2 requesting response to 27 questions. Is there allowance for a separate capabilities statement beyond the 10-page limit?

Responders to this RFI can utilize a separate page for capabilities statements or diagrams.

63 What was the impetus for issuing the TIES RFI? The Federal cyber ecosystem faces challenges creating, using and sharing cyber threat intelligence. Recent major cybersecurity incidents, like SolarWinds and the Microsoft Exchange hack, have demonstrated a need for a common cyber threat intelligence enterprise solution. Fragmented information about cyber threats hinders federal analysts’ ability to make timely and informed mission decisions. Due to these concerns, CISA is seeking ways to enable Federal analysts and network defenders to collaborate (chat, tag, query) across the various sources of CTI to develop an accurate and shared threat picture.

64 How does CISA currently manage its Cyber Threat Intelligence capabilities? Are the various capabilities that will be housed In this enterprise service scattered across the agency? (found the below in the RFI)

CISA currently provides commercial threat intelligence information to its customers through disparate enterprise license agreements. CISA's vision is to centralize unclassified cyber threat data in a single solution for its Federal community partners, making commercial and non-commercial threat intelligence and information more broadly accessible and available across the Federal enterprise.

65 Why is this enterprise service needed right now? The increasing sophistication of the threat actors that target federal networks and systems demands CISA find new and efficient ways to share CTI analysis, information, and intelligence across the federal government. CISA is exploring novel approaches that bring to bear the insights of the entire federal enterprise through near real time CTI exchange and collaboration.

66 Is there an estimated ceiling for this award? This RFI is for information and planning purposes only and does not constitute a Request for Quote; it is not to be construed as a commitment by the U.S. Government. No award will be made from this RFI.

67 When will sector-specific guidance for critical infrastructure sectors begin to roll out? Is there an order/will certain sectors be prioritized?

CISA envisions this CTI solution will directly support federal civilian executive branch government agencies. The Sector Risk Management Agencies (SRMAs) will continue to work closely with sectors to support their needs.