6108 Questions-Responses.pdf
PDF 51 KB Posted
- Attached to
- Third-Party Application Management
- Solicitation number
- S-44300-00014492
- Issued by
- Oregon
About this file
This document is a question and answer (Q&A) file related to a patch management solution request for the Oregon Department of Human Services (ODHS) and Oregon Health Authority (OHA). The document outlines key requirements and clarifications for a patch management system, focusing on integration capabilities, deployment flexibility, and specific technical requirements. The Q&A addresses questions about SIEM system integration, geographical support for patch deployment, requirement classifications, and post-deployment patch validation mechanisms.
The key requirements include mandatory and preferred integrations with systems like Active Directory, SCCM, Intune, and SIEM, with the current SIEM being owned by DAS-EIS and using Q-RADAR and Microsoft Sentinel. The solution must support deploying patches across different organizational locations and time zones, provide automation capabilities, ensure patch delivery security within the United States, support compliance and zero-day patch availability, offer a centralized management console, and be scalable for enterprise operations. The document emphasizes that while some integrations are preferred, others are strictly required, and post-deployment patch success validation is a key requirement.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 6108-0 RFQ for Third Party Patch Management System Final2.pdf | ||
| ITB-SWISS WEBSTER MICE.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Number Question
1 The Key requirements state that there must be integration with e SIEM system. Are we required to create a new SIEM solution to track the patch management solution, or will this be integrated with ODHS/OHA’s existing SIEM?
The current SIEM is owned and operated by DAS-EIS. Integration is desired but not a requirement. DAS-EIS uses Q-RADAR and Microsoft Sentinel.
2 The Patch Deployment Flexibility requirement asks for “Geographical Support”. What exactly does this mean? Does this just mean that the solution can be accessed from anywhere?
The solution must support deploying patches across different organizational locations and geographic regions, with scheduling flexibility to accommodate local time zones.
3 Key Requirements; multiple requirements listed have a “Yes or No” followed by “Required”.
Some just say “Required”. For example “Automation Capabilities: No, Required”. What is the Yes/No for? Can you clarify what is required from this list?
Here is a rebuild of those Key Requirements for clarity:
1. Supported Platforms and Applications: Required
2. Automation Capabilities: Required
3. Granular Control, Reporting, and Alerts: Preferred
4. Vulnerability Management Integration: Preferred
5. Security of Patch Delivery and Cloud Data Stored in the United States:
Required
6. Compliance Support and Zero-Day Patch Availability: Required
7. Centralized Management Console and Ease of Deployment: Required
8. Scalability for Enterprise Operations: Required
9. Integration with Active Directory: Required SCCM: Preferred Intune: Preferred SIEM: Preferred
4 Do mechanisms exist for validating patch success and system stability post-deployment? Is this something to be scoped into this RFQ as a vendor responsibility?
Validating patch success is a requirement. Thinking in terms of post-deployment reporting.
File details come from the government source that posted it. Updated .