Original Contract - Divergent.pdf

State Term Contract

No. 43230000-24-STC

For

Digital Security Solutions

This State Term Contract No. 43230000-24-STC (“Term Contract”) is between the Department of

Management Services (“Department”), an agency of the State of Florida, located at 4050

Esplanade Way, Tallahassee, Florida 32399; and Divergent Solutions, LLC (“Contractor”) with its principal place of business located at 221 West Park Avenue, Unit 204, Tallahassee, FL 32301;

collectively referred to herein as the “Parties.”

WHEREAS, the Department issued a competitive solicitation for Digital Security Solutions; and

WHEREAS, the Contractor was awarded as a result of such competitive solicitation to offer the following proposed Solution(s):

NOW THEREFORE, in consideration of the mutual promises contained herein, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:

I. Term and Effective Date.

The initial term of the Term Contract shall be for 2 years. The Term Contract will become effective on March 1, 2025 , or on the date signed by all Parties, whichever is later. The Term

Contract shall expire on February 28, 2027 unless terminated earlier or renewed in accordance with Exhibit C, Enterprise Standard Terms and Conditions.

II. Order of Precedence.

This contract document and the attached exhibits constitute the Term Contract and the entire understanding of the Parties. All Exhibits listed below are incorporated into this Term Contract by reference herein. In the event of a conflict, the Term Contract document and Exhibits shall have priority in the following order:

a) This contract document

b) Exhibit A, Scope of Work

c) Exhibit B, Price Sheet

d) Exhibit C, Enterprise Standard Terms and Conditions

e) Exhibit D, Technical Response(s) to the competitive solicitation

f) Exhibit E, PUR 7801

Docusign Envelope ID: 1B88AA27-DD03-4BF7-8D05-A9A6D044B445

State Term Contract No. No. 43230000-24-STC

III. Purchases off this Term Contract.

Upon execution of this Term Contract, Customers, as defined in Exhibit D, Enterprise

Standard Terms and Conditions, may purchase products and services under this Term

Contract. Any entity making a purchase off of this Term Contract acknowledges and agrees to be bound by the terms and conditions of this Term Contract. The Contractor shall adhere to the terms included in any contract or purchase orders issued pursuant to this Term

Contract.

IV. Primary Contacts.

Department’s Contract Manager:

Christopher McMullen

Division of State Purchasing

Florida Department of Management Services

4050 Esplanade Way, Suite 360

Tallahassee, Florida 32399-0950

Telephone: (850) 922-9867

Email: Christopher.mcmullen@dms.fl.gov

Contractor’s Contract Manager:

David Clark

Divergent Solutions, LLC

221 West Park Avenue Unit 204

Tallahassee, FL 32301

Telephone: (850) 545-1887

Email: david@divergent-one.com

Either party may notify the other by email of a change to a designated Contract Manager providing the contact information for the newly designated contact, and such notice is sufficient to effectuate this change without requiring a written amendment to the Term Contract.

IN WITNESS THEREOF, the Parties hereto have caused this Term Contract to be executed by the undersigned duly authorized undersigned officials.

State Term Contract No. No. 43230000-24-STC

Divergent Solutions, LLC STATE OF FLORIDA, DEPARTMENT OF

MANAGEMENT SERVICES

Pedro Allende, Secretary

Date: Date:

Docusign Envelope ID: 1B88AA27-DD03-4BF7-8D05-A9A6D044B445

David Clark

3/28/2025 | 1:26 PM EDT 3/31/2025 | 7:47 PM EDT

43230000-24-STC Page 1 of 24

Exhibit A

Scope of Work

1. Purpose To provide Customers with statewide Digital Security Solutions, pursuant to the terms set forth in this Scope of Work. Digital Security Solutions must be provided in accordance with Chapter 282, Florida Statutes (F.S.), Rule Title 60GG, Florida Administrative Code (F.A.C.), and cybersecurity best practices. Digital Security Solutions must meet or exceed the applicable state and federal laws, regulations, and standards for cybersecurity, including the National Institute of Standards and Technology Cybersecurity Framework.

2. Definitions

Definitions contained in section 287.012, F.S.; Rule 60A-1.001, F.A.C.; Attachment D, Enterprise Standard Terms and Conditions; and the PUR 1000, General Contract Conditions, are incorporated by reference. In the event of a conflict, the definitions listed in this section supersede the incorporated definitions for the purposes of this Scope of Work. All definitions apply in both their singular and plural sense.

Add-On Services – Non-core or additional services available for purchase to enhance or support a Solution.

Business Day – Monday through Friday, inclusive, except for those holidays specified in section 110.117, F.S., from 8:00 a.m. to 5:00 p.m. at the Customer’s location.

Commodity Code – The State’s numeric code for classifying commodities and contractual services which meet specific requirements, specifications, terms, and conditions herein. Florida has adopted the United Nations Standard Products and Services Code (UNSPSC) for classifying commodities and services.

Confidential Information – Information that is trade secret or otherwise confidential or exempt from disclosure under Florida or federal law.

Contract Manager – The representative designated by the Department who will oversee all aspects of the Contract, monitor performance expectations, and serve as the primary point of contact for the Contractor.

Criminal Justice Information Services (CJIS) – Services providing access to national or local criminal justice information.

Digital Security Solutions(s) – The products, services, or software that meet the needs of a Service Category. May be used interchangeably with Solution.

Identity and Access Management Systems (IAM) – A Framework that provides/controls user access to critical information within their organization.

43230000-24-STC Page 2 of 24

International Organization for Standardization (ISO) – An independent, non-governmental, international standard development organization composed of representatives from the national standards organization of member countries.

Manufacturer – The producer or provider of Digital Security Solutions. May be used interchangeably with Brand Name.

Service Category(ies) – The categories of products and services under this Contract. The Service Categories are: Endpoint-Based Asset Discovery; Network-Based Asset Discovery;

Endpoint Detection and Response; External-Facing Asset Discovery; Email Security; Content Delivery Network; Security Operations Platform (SOP); Identity and Access Management (IAM);

Mobile Security and Threat Detection; Secure Access Service Edge (SASE); Governance, Risk, and Compliance (GRC); IT Service Management (ITSM); Vulnerability Assessment and Management; Cybersecurity Threat Intelligence (CTI), Data Security, and Enterprise Security Log Management, Analytics, and Response.

Value-Added Services - Value-added services include any additional services the Contractor offers, for no additional cost to the Customer, as part of the Term Contract, and which clearly exceed the minimum requirements and are within the scope of this Term Contract. An example of value-added services would be, “The Contractor will provide a year of 24/7 support services, at no cost to the Customer.” Any value-added service proposed by the Contractor, if accepted by the Customer, shall become a requirement and be a part of the minimum service specifications contained in any resulting Purchase Order.

3. Scope of Work

3.1 Digital Security Solutions Requirements:

All Solutions shall adhere to the following minimum specifications:

3.1.1 Compliance

Solution shall comply with relevant industry standards and regulations applicable to the State of Florida and the relevant state agency (e.g., CJIS, HIPAA, SOX, PCI-DSS, NIST

CSF).

3.1.2 Scalability

Solution shall scale to accommodate current and future growth of the Customer, handling both increased workloads and expansion across additional devices, users, or systems.

3.1.3 Reliability

Solution shall provide high availability and reliability, with minimal downtime and robust disaster recovery capabilities to ensure business continuity.

3.1.4 Interoperability

Solution shall have the ability to, in response to a Customer Request for Quote, provide seamless integration with Customer systems, applications, and infrastructures detailed in the Request for Quote, ensuring that the Solution can coexist within the Customer IT ecosystems without requiring major overhauls.

43230000-24-STC Page 3 of 24

3.1.5 User-Friendly Interface

Solution shall provide an intuitive and easy-to-use interface for both IT staff and end-users, ensuring that tasks can be performed efficiently regardless of the technical proficiency of the user.

3.1.6 Data Protection

Solution shall ensure data is encrypted both at rest and in transit using industry-standard encryption algorithms.

3.1.7 Access Controls

Solution shall include Role-Based Access Control (RBAC) and Multi-Factor Authentication (MFA) for managing user access. Comprehensive logging and auditing capabilities to track data access, configuration changes, and security events.

3.1.8 Confidentiality Agreements

Solution shall have the ability to implement and enforce confidentiality agreements between Customers and the Contractor upon request of the Customer.

3.1.9 API and SDK Availability

Solution shall provide availability of APIs and SDKs for custom integrations and extending functionality where needed.

3.1.10 Support for Cloud and On-Premise Environments

Solution shall support hybrid environments, including cloud-based, on-premises, and multi-cloud deployments where applicable.

3.1.11 Log Forwarding

Solution shall, where feasible, be able to integrate logs with external log aggregation systems such as SIEMs, ensuring that critical data is available for analysis and audit purposes.

3.1.12 Staff Training

Solution shall include training sessions on best practices and implementation. Ongoing training resources shall be made available as part of the Solution to ensure staff are knowledgeable about the Solution.

3.1.13 Ongoing Support

Solution shall provide availability of ongoing support and consultation services, including SLAs for issue resolution and dedicated account managers or customer success teams.

3.1.14 Documentation and Resources

Solution shall provide access to comprehensive documentation, user guides, and online resources for continuous learning and improvement. Regular webinars, user community forums, and/or knowledge-sharing platforms to keep users informed of updates or best practices.

The Technical Response Attachments L1-L16 define the requirements for the Service

Categories. A Technical Response, submitted for an awarded Solution named therein, along with any provided Solution Service Level Agreements, shall form part of a Vendor’s resulting

Term Contract. The Service Categories, as detailed below and in the Technical Response

43230000-24-STC Page 4 of 24

Attachments, define the expected functions and objectives of each Service Category, giving

Vendors a clear understanding of what is needed to support the State of Florida's digital security and operational requirements.

Each Service Category includes a detailed description of the Solution’s purpose that a Solution must address, followed by a section which includes “Solutions should provide”, which lists the technical capabilities and features that are generally expected for a Solution. Vendors are encouraged to propose Solutions that meet these capabilities; however, it is not required for a

Solution to fulfill every part of the listed capabilities. Instead, the intent is to provide a comprehensive guideline for Vendors to design and tailor their Solution in alignment with the

State's needs, while allowing flexibility based on the strengths and specific functionalities of its offering.

3.2 Service Category 1: Endpoint-Based Asset Discovery:

An Endpoint-Based Asset Discovery Solution must continuously scan, detect, and inventory all endpoint devices, including, but not limited to laptops, desktops, servers, and any other connected devices across the enterprise. The Solution must utilize lightweight agents that are deployed via endpoints, consuming minimal CPU and memory resources to avoid degrading performance or user experience.

The Service Category 1: Endpoint-Based Asset Discovery should provide:

3.2.1 Real-Time Asset Discovery

Solution should run continuously, detecting new devices as they connect to the network.

This should include remote devices.

3.2.2 Detailed Hardware and Software Inventories

Solution should include inventory of processor types, memory, storage, installed software, patch levels, operating system versions, and device configurations.

3.2.3 Customizable Asset Classifications

Solution should allow administrators to tag devices by type, location, or business unit for easier management.

3.2.4 Agent Health Monitoring

Solution should ensure that agents are functioning correctly and can be managed or repaired from a central console, if necessary. The Solution should provide alerts if an agent becomes inactive or fails to report.

3.2.5 Centralized Management Console

Solution should provide a centralized management console that displays an up-to-date view of all discovered endpoints, including non-standard devices such as personal mobile devices or tablets.

3.2.6 Compliance Enforcement

Solution should provide alerts to where endpoints that fail to meet security requirements (e.g., outdated patches or unauthorized software) can be flagged for remediation.

43230000-24-STC Page 5 of 24

3.2.7. Integration of CTI Data Feeds

Solution should provide real-time insights into endpoint vulnerabilities, ensuring that newly discovered devices are checked against the latest IoCs (Indicators of Compromise) and CVEs (Common Vulnerabilities and Exposures) behaviors targeting specific operating systems or device types.

3.2.8 Patching and Deployment Capability

Solutions should provide endpoint patch and deploy services which allows managing patch and deployment of operating system and application updates on systems utilizing the agent.

3.2.9 Metrics

Solution should provide the ability to roll-up patch and deployment level metrics across the domain.

3.3 Service Category 2: Network-Based Asset Discovery:

A Network-Based Asset Discovery Solution identifies devices and systems communicating within the network infrastructure without the need for software agents to be deployed to most endpoints or servers. By analyzing network traffic, the Solution should detect all connected assets, including those that do not run traditional operating systems, such as Internet of Things (IoT) devices, switches, routers, and printers.

The Service Category 2: Network-Based Asset Discovery should provide:

43230000-24-STC Page 6 of 24

3.3.1 Agentless Discovery

Solution should be capable of using passive network scanning techniques that observe network traffic and communications, including deep packet inspection (DPI) and flow-based analysis.

3.3.2 Continuous Network Monitoring

Solution should automatically detect new devices as they are added to the network, whether they are traditional endpoints, virtual machines, or IoT devices.

3.3.3 Granular Device Identification

Solution should collect metadata such as MAC address, IP address, operating system, software versions, device make and model and open ports.

3.3.4 Network Topology Visualization

Solution should map discovered devices and displays how they connect and communicate within the network. The visualization should dynamically update as devices are added, removed, or reconfigured.

3.3.5 Customizable Device Grouping and Tagging

Solution should allow administrators to categorize assets based on network segment, physical location, or function (e.g., servers, IoT, printers).

3.3.6 Vulnerable Detection

Solution should identify outdated software versions, unpatched firmware, or insecure configurations that could expose the network to threats.

3.3.7 Integration of CTI Data Feeds

Solution should provide real-time insights into suspicious network activity, such as communication with known malicious IP addresses or domains. Solution should flag devices that may be compromised or communicating with threat actors.

3.4 Service Category 3: Endpoint Detection and Response:

An Endpoint Detection and Response Solution is designed to provide continuous and comprehensive monitoring of endpoint activities to detect, investigate, and respond to threats in real-time. The Solution collects and analyzes detailed telemetry data, such as file access patterns, process execution, network connections, and registry changes, to identify malicious behavior that traditional antivirus software might miss.

The Service Category 3: Endpoint Detection and Response should provide:

3.4.1. Real-Time Monitoring and Logging

Solution should provide real-time monitoring and logging of all endpoint activities, including, but not limited to, file changes, process creation and termination, registry edits, network connections, and USB device insertion.

3.4.2. Behavioral Analytics

Solution should use an extended portfolio of security tools, like endpoint firewalls, device and application control, application inventory, signature matching, vulnerability and patch management and others, plus network-level tools such as secure email and sandboxing.

43230000-24-STC Page 7 of 24

3.4.3. Forensic Capabilities

Solution should allow security analysts to investigate historical endpoint activities, enabling root cause analysis and providing a detailed timeline of events leading up to a security incident.

3.4.3. Automated Response Mechanisms

Solution should take predefined actions when threats are detected, such as isolating the affected device from the network, terminating malicious processes, or blocking IP addresses.

3.4.4 Threat Hunting Tools

Solution should allow analysts to query across the entire organization’s endpoints, searching for specific indications or compromise (IoCs) or patterns that may indicate the presence of advanced threats.

3.4.5 Support for Remote Endpoints

Solution should ensure that devices outside of the network, such as remote or mobile works, are protected and monitored regardless of location.

3.4.6 Remediation Playbooks

Solution should provide detailed guidance for resolving detected incidents, including step-by-step instructions for isolating infected devices, rolling back malicious changes, and restoring systems toa known good state.

3.4.7 Integration of CTI Data Feeds

Solution should provide real-time updates on emerging malware strains, threat actor campaigns, and new attack vectors targeting endpoints. The EDR Solution can use CTI feeds to compare endpoint behavior when known IoCs, enhancing detection and automated response capabilities.

3.48. Forensic Capabilities

Solution should allow security analysts to investigate historical endpoint activities, enabling root cause analysis and providing a detailed timeline of events leading up to a security incident.

3.5 Service Category 4: External-Facing Asset Discovery:

External-Facing Asset Discovery Solutions must help organizations identify and assess the security of their publicly accessible digital assets, such as web servers, cloud services, applications, and other internet-facing systems. The Solution must continuously scan the organization’s external IP ranges and domains to identify assets that are exposed to the internet and assess their vulnerabilities.

The Service Category 4: External-Facing Asset Discovery should provide:

3.5.1 Continuous Scanning

43230000-24-STC Page 8 of 24

Solution should provide continuous scanning of public IP addresses and domains associated with the organization, identifying all internet-facing services, applications, and network devices.

3.5.2 Service Detection and Banner Grabbing

Solution should collect information such as service versions, SSL/TLS certificate details, and software configurations for each exposed asset.

3.5.3 Identification of Outdated Software

Solution should identify outdated software or insecure configurations, such as weak SSL certificates, open ports, misconfigured DNS settings, or vulnerable software versions that could be exploited by attackers.

3.5.4 Integration with Vulnerability Databases

Solution should integrate with vulnerability databases such as CVE, CWE, and the National

Vulnerability Database to provide immediate context around known vulnerabilities affecting identified services or software.

3.5.5 Risk Scoring

Solution should accommodate risk scoring of external assets, prioritizing those that are most vulnerable to exploitation or are most critical to business operations.

3.5.6 Customizable Alerting

Solution should notify security teams when a new external asset is detected, a known vulnerability is identified, or a change in configuration occurs (e.g., a certificate has expired).

3.5.7 Integration of CTI Data Feeds

Solution should correlate external-facing assets with current threat actor campaigns or vulnerabilities that are actively being exploited. This ensures that publicly exposed services are continuously monitored against known threats in real-time.

3.6 Service Category 5: Email Security:

Email Security Solutions must protect against email-based threats such as phishing, malware, ransomware, and email compromises. The Solution should analyze both inbound and outbound email communications in real-time, using advanced detection techniques to filter malicious content without disrupting legitimate business correspondence.

The Service Category 5: Email Security should provide:

3.6.1 Content Filtering

The Solution should break down files to their discrete components in real-time and reconstruct a clean version of the email, removing anything that doesn't conform with the file type specifications, a nationally recognized standard, or company policy.

3.6.2 Phishing Detection

Solution should analyze the email’s context, structure, and metadata (e.g., header

43230000-24-STC Page 9 of 24 information) to detect phishing attempts, which may include spear-phishing and targeted attacks.

3.6.3 Sandboxing Technology

Solution should have the capability to safely execute email attachments and embedded links in an isolated environment to determine if they are malicious before delivery to the recipient.

3.6.4 Advanced Anti-Spoofing Protections

Solution should include enforcement of Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) protocols to prevent sender impersonation.

3.6.5 Email Encryption

Solution should include encryption for sensitive communications, ensuring enforcement that messages are encrypted both in transit and at rest.

3.6.6 End-User Awareness Features

Solution should include automatic banners or warnings added to suspicious emails, helping users recognize potential threats.

3.3.7 Quarantine and Remediation Tools

Solution should provide quarantine and remediation tools for administrators, allowing them to review flagged messages, release legitimate emails mistakenly identified as threats, and block harmful content.

3.7 Service Category 6: Content Delivery Network:

A Content Delivery Network (CDN) optimizes the delivery of web content by distributing it across a network of edge servers located globally. This reduces latency, improves page load times, and enhances the user experience, especially for content-heavy websites or applications. The Solution must ensure secure and efficient content delivery, while providing protection against common web-based attacks through mitigation of attacks such as distributed denial of service or web application exploits.

The Service Category 6: Content Delivery Network should provide:

3.7.1 Distributed Edge Server Architecture

Solution should allow content to be cached and served from the server closest to the end-user to reduce latency and improve performance.

3.7.2 Support for Dynamic Content Acceleration

Solution should optimize the delivery of personalized or frequently updated content through intelligent routing and caching mechanisms.

3.7.3 Content Caching Controls

Solution should allow administrators to define TTL (time-to-live) values, cache purging rules, and caching policies that align with the organization’s needs.

43230000-24-STC Page 10 of 24

3.7.4 Integrated DDoS Mitigation

Solution should protect web applications from volumetric attacks by filtering malicious traffic before it reaches the origin server.

3.7.5 Integrated Web Application Firewall

Solution should protect web applications from exploits.

3.7.6 Real-Time Traffic Analytics

Solution should provide insights into website traffic, user behavior, cache hit/miss ratios, and security incidents such as DDoS attempts or SSL handshake failures

3.7.7 Customizable Caching Rules

Solution should allow selective caching of specific content types (e.g., static images, JavaScript files, or video files) and exclusion of sensitive or dynamic data from the cache.

3.7.8 Integration of CTI Data Feeds

Solution should allow the CDN to identify and block traffic from known malicious IP addresses or domains, as well as protecting against emerging DDoS threats flagged by threat intelligence.

3.8 Service Category 7: Security Operations Platform:

The Security Operations Platform (SOP) must integrate multiple security tools and technologies into a single unified platform, providing comprehensive visibility into an organization’s IT environment. The Solution should allow security teams to detect, investigate, and respond to threats in real-time, correlating data from across the infrastructure to provide a holistic view of security incidents.

The Service Category 7: Security Operations Platform should provide:

3.8.1 Log Event Aggregation and Correlation

Solution should log event aggregation and correlation from various security devices (firewalls, IDS/IPS, endpoint detection tools, network devices, and cloud services) to identify patterns and indicators of compromise.

3.8.2 Automated Incident Response Workflows

Solution should allow security operations teams to optionally automate common tasks such as blocking IP addresses, isolating infected devices, or generating alerts for further investigation.

3.8.3 Real-Time Threat Detection

Solution should be powered by machine learning models and behavioral analytics, capable of identifying zero-day attacks, insider threats, and anomalous activities that deviate from the organization's baseline.

3.8.4 Customizable Dashboards

Solution should have dashboards displaying real-time security metrics, providing visualizations of key performance indicators (KPIs) such as the number of incidents, time-to-respond, or threat severity.

3.8.5 Incident Management Capabilities

43230000-24-STC Page 11 of 24

Solution should provide detailed incident tracking, ticketing integration, and root cause analysis, ensuring that all security events are fully documented and addressed.

3.8.6 Integration with Threat Intelligence Platforms (TIPs)

Solution should enrich security alerts with contextual information about current threat actors, malware campaigns, and indicators of compromise

3.8.7 Integration of CTI Data Feeds

Solution should Allow for real-time enrichment of alerts, correlating incidents with known global threat actor campaigns, IoCs, and TTPs (Tactics, Techniques, and Procedures), improving situational awareness and response times.

3.9 Service Category 8: Identity and Access Management (IAM):

IAM Solutions must provide centralized management for digital identities and control access to systems and data based on organizational policies. The Solution should manage the full lifecycle of user identities, from onboarding to de-provisioning, and enforce access control through role-based (RBAC) and attribute-based (ABAC) mechanisms.

The Service Category 8: Identity and Access Management (IAM) should provide:

3.9.1 Single Sign-On (SSO)

Solution should be compatible across on-premise and cloud based applications, reducing password fatigue and ensuring a seamless login experience for users.

3.9.2 Multi-Factor Authentication (MFA)

Solution should provide enforcement, supporting various authentication methods (e.g., Time-based one-time Password (TOTP), Short Message Service (SMS), biometrics) to add an extra layer of security.

3.9.3 Role-Based Access Control (RBAC) and Attribute-Based Control (ABAC) Solution should include mechanisms, enabling fine-grained access permissions based on user roles or attributes such as location, department, or security clearance.

3.9.4 Federated Identity Management

Solution should allow cross-domain authentication using standard protocols like Security Assertion Markup Language (SAML), Open Authorization (OAuth), and OpenID Connect.

3.9.5 Privileged Access Management (PAM)

Solution should provide capabilities to control and monitor the use of administrative or high-privilege accounts, ensuring that elevated access is limited and auditable.

3.9.6 Self-service Functionality

Solution should allow users to manage their own passwords, request access to systems, and track the status of access requests through an approval workflow.

3.9.8 Integration of CTI Data Feeds

Solution should allow the IAM system to detect compromised credentials, suspicious login attempts, or help identify identity-related threat actor activities in real-time.

43230000-24-STC Page 12 of 24

3.10 Service Category 9: Mobile Security and Threat Detection:

Mobile Security Solutions must protect mobile devices (smartphones, tablets, and laptops) from unauthorized access, data leakage, and malware while maintaining compliance with security policies. The Solution should work across iOS, Android, and other mobile operating systems, integrating with Mobile Device Management (MDM) platforms to enforce security policies and track compliance.

The Service Category 9: Mobile Security and Threat Detection should provide:

3.10.1 Mobile Threat Detection

Solution should include capabilities that monitor device behavior, app activity, and network connections for suspicious activities such as unauthorized data access, unapproved app installations, or malware downloads.

3.10.2 Mobile Application Management (MAM)

Solution should manage and secure the use of both enterprise and personal apps on mobile devices, including the ability to blacklist unsafe apps or restrict certain app permissions.

3.10.3 Device Encryption Enforcement

Solution should ensure that all data stored on the device is encrypted using industry-standard encryption algorithms (AES-256).

3.10.4 Remote Wipe and Lock Capabilities

Solution should enable administrators to remotely erase data from lost or stolen devices to prevent unauthorized access.

3.10.5 VPN Enforcement

Solution should ensure that all mobile data traffic is securely transmitted through encrypted channels, even when using public Wi-Fi networks.

3.10.6 Behavioral Analytics

Solution should identify anomalous activities on mobile devices, such as attempts to bypass security controls or connect to unauthorized networks.

3.10.7 Integration with MDM Solutions

Solution should enforce policies for password strength, screen lock timers, device encryption, and software updates.

3.10.8 Geo-Fencing Capabilities

Solution should allow administrators to restrict device functionality or access based on geographic location.

3.10.9 Integration of CTI Data Feeds

Solution should detect mobile-specific malware, phishing campaigns, or command-and-control traffic targeting mobile devices, providing real-time intelligence to block such threats.

3.11 Service Category 10: Secure Access Service Edge (SASE):

43230000-24-STC Page 13 of 24

SASE Solutions combine networking and security services, delivering both through a cloud-based framework that supports remote users, branch offices, and cloud applications. The Solution integrates Software-Defined Wide Area Networking (SD-WAN) with advanced security features like Secure Web Gateway (SWG), Cloud Access Security Broker (CASB), Zero Trust Network Access (ZTNA), and Firewall as a Service (FWaaS).

The Service Category 10: Secure Access Service Edge (SASE) should provide:

3.11.1 SD-WAN with Policy-Based Routing

Solution should enable dynamic, intelligent path selection to ensure optimal network performance for applications, even across distributed cloud environments.

3.11.2 Zero Trust Network Access (ZTNA) Principles

Solution should enforce least-privilege access to applications based on identity and context (e.g., user role, device health, location) rather than assuming trust based on network location.

3.11.3 Secure Web Gateway (SWG)

Solution should include features that protect users from web-based threats, such as malware, malicious URLs, and phishing attempts, by inspecting traffic at the cloud edge and enforcing acceptable use policies.

3.11.4 Firewall as a Service (FwaaS)

Solution should deliver consistent firewall policies across multiple locations and devices, centralizing management of security controls such as network segmentation, access control, and intrusion detection.

3.11.5 Real-Time Analytics and Reporting

Solution should provide insights into network performance, traffic patterns, security threats, and user behavior across distributed environments.

3.11.6 Integration of CTI Data Feeds

Solution should detect and block malicious network traffic or unauthorized access attempts based on real-time threat intelligence, correlating user activity and network behavior with known threat actors or compromised infrastructure.

3.11.7 Cloud Access Security Broker (CASB)

Solution should integrate to provide visibility and control over cloud applications and services, monitoring and securing data stored in third-party SaaS platforms.

3.12 Service Category 11: Governance, Risk, and Compliance (GRC):

GRC Solutions should provide a structured approach to managing governance frameworks, assessing enterprise risks, and ensuring compliance with industry regulations. The Solution must facilitate the development of policies, automate compliance checks, and enable risk management and assessment workflows that align with business objectives.

43230000-24-STC Page 14 of 24

The Service Category 11: Governance, Risk, and Compliance (GRC): should provide:

3.12.1 Centralized Policy Management

Solution should allow the creation, distribution, and tracking of governance frameworks, compliance guidelines, and operational policies. The Solution should support version control and electronic signatures for policy acceptance.

3.12.2 Risk Assessment Tools

Solution should enable organizations to identify, assess, and prioritize risks across departments or business units based on likelihood and impact.

3.12.3 Risk Mitigation and Treatment Workflows

Solution should allow teams to define and track risk response plans, assign responsibilities, and monitor progress toward mitigation goals.

3.12.4 Audit Management Capabilities

Solution should support the planning, scheduling, and execution of internal and external audits. The platform should automatically generate audit reports, track findings, and ensure follow-up actions are completed.

3.12.5 Compliance Tracking

Solution should include industry-specific regulations (e.g., NIST CSF, GDPR, HIPAA, PCI-DSS), with automated controls and real-time monitoring to detect non-compliance or control failures.

3.12.6 Customizable Risk Dashboards

Solution should provide executives with an overview of key risks, compliance metrics, and the overall health of the governance program. Dashboards should display real-time data and support drill-down views for detailed analysis.

3.12.7 Third-Party Risk Management

Solution should facilitate the assessment of third-party vendor risks and perform due diligence on vendors' compliance and risk management practices.

3.13 Service Category 12: IT Service Management (ITSM):

ITSM Solutions are designed to streamline the delivery and management of IT services by providing a structured approach to incident management, problem resolution, change control, and service request fulfillment. The Solution should support automation, self-service capabilities, and detailed reporting on service levels.

The Service Category 12: IT Service Management (ITSM) should provide:

3.13.1 Automated Incident Management Workflows

Solution should detect, categorize, and prioritize IT incidents based on predefined rules.

The system should support automatic escalation and notification of incidents to the appropriate teams.

3.13.2 Self-Service Portal

43230000-24-STC Page 15 of 24

Solution should enable end-users to submit service requests, track the status of requests, and access knowledge base articles for self-help. The portal should integrate with automated fulfillment workflows, reducing the need for manual intervention.

3.13.3 Change Management Tools

Solution should include request and approval workflows, risk assessment for changes, and automated enforcement of change windows and rollback plans.

3.13.4 Configuration Management Database (CMDB)

Solution should track all configuration items (CIs) within the IT infrastructure, including hardware, software, networks, and cloud assets. The CMDB should map dependencies between CIs and provide insights into potential impact during incident resolution or change requests.

3.13.5 Service Level Management

Solution should define, monitor, and report on Service Level Agreements (SLAs). The system should automatically calculate performance metrics such as response time, resolution time, and service availability, and provide real-time dashboards.

3.13.6 Pre-Buit Integrations

Solution should include monitoring tools, security platforms, and asset management systems to provide full visibility into the health and performance of IT services.

3.13.7 Integration of CTI Data Feeds

provide insights into security incidents or vulnerabilities that could affect IT service delivery, allowing ITSM platforms to correlate service disruptions with known global security threats.

3.14 Service Category 13: Vulnerability Assessment and Management:

Vulnerability Assessment and Management Solutions must enable organizations to continuously scan their IT assets for security vulnerabilities, evaluate the risks associated with these vulnerabilities, and prioritize remediation efforts. The Solution should automate both scanning and remediation workflows, providing real-time visibility into the organization’s security posture.

The Service Category 13: Vulnerability Assessment and Management should provide:

3.14.1 Automated and Continuous Vulnerability Scanning

Solution should include automated and continuous scanning of network devices, servers, endpoints, and applications. The scans should identify known vulnerabilities (e.g., CVEs), misconfigurations, and missing patches.

3.14.2 Risk-Based Vulnerability Prioritization

Solution should allow vulnerabilities to be sorted and ranked based on the criticality of the affected asset, the exploitability of the vulnerability, and the business impact. This helps organizations focus on high-priority issues that pose the most risk.

3.14.3 Remediation Workflows

43230000-24-STC Page 16 of 24

Solution should integrate with IT service management (ITSM) systems, automatically creating tickets or work orders for IT teams to address vulnerabilities, track progress, and close issues once remediated.

3.14.4 Detailed Vulnerability Reports

Solution should include the ability to provide reports including information such as affected assets, severity ratings (e.g., CVSS scores), vulnerability descriptions, and recommended fixes.

3.14.5 Real-Time Insights and Trend Analysis

Solution should provide insights into the overall security posture, such as the number of open vulnerabilities, time-to-remediation, and patch compliance rates.

3.14.6 Integration with Patch Management Solutions

Solution should allow organizations to deploy patches to vulnerable systems directly from the platform.

3.14.7 Integration of CTI Data Feeds

Solution should enhance vulnerability prioritization by providing real-time threat intelligence on active exploitation campaigns, emerging threats, or vulnerabilities that are being specifically targeted by threat actors.

3.15 Service Category 14: Cybersecurity Threat Intelligence (CTI):

Cybersecurity Threat Intelligence (CTI) Solutions must aggregate threat data from multiple sources, analyze it to uncover emerging threats, and provide actionable intelligence to enhance security defenses. The Solution should integrate with an organization’s existing security operations workflows, ensuring that threat intelligence is used to improve detection, prevention, and response efforts.

The Service Category 14: Cybersecurity Threat Intelligence (CTI) should provide:

3.15.1 Threat Data Aggregation

Solution should include open-source threat feeds, paid subscriptions, and proprietary sources. The platform should support integration with standards-based threat intelligence feeds such as STIX, TAXII, and others.

3.15.2 Threat Intelligence Platform (TIP)

Solution should consolidate and normalizes threat data, making it easy to share actionable intelligence with internal teams or external partners on a platform that has the capability to integrate with the CTI Solution. The platform should provide support for enrichment, scoring, and threat actor profiling.

3.15.3 Real-Time Threat Alerts

Solution should notify Customer designated security teams of emerging threats relevant to their environment, such as new vulnerabilities, malware campaigns, or attack techniques in real time. Alerts should include contextual information such as indicators of compromise (IoCs), threat actor motivations, and recommended mitigations.

3.15.4 Custom Intel

43230000-24-STC Page 17 of 24

Solution should include the ability to incorporate threat intelligence feeds and manual intelligence to include custom work/intel.

3.15.5 Customer Feeds

Solution should include the ability to potentially change feeds if needed to include, remove, or modify research, analysis, and intelligence feeds.

3.15.6 Integration with SIEM, SOAR, and SOC Tools

Solution should provide contextual threat intelligence directly within the security operations workflow. This integration should enable automated response actions such as blocking malicious IP addresses or adjusting firewall rules based on threat intelligence.

3.15.7 Feed Control

Solution should include Capabilities for incorporating premium feeds and manual intelligence.

3.15.8 Dynamic Threat Detection

Solution should include the ability to provide tailored threat intelligence focusing on specific threats relevant to an organization’s unique environment, including industry-specific and organization specific risks and potential adversaries, ensuring that security measures are aligned with real-world scenarios.

3.15.9 Threat Context

Solution should include the ability to provide contextual awareness threat intelligence, to include custom intelligence, that provides insights that consider the broader context of an organization’s operations, including user behavior, network architecture, and business priorities, allowing for more informed risk management.

3.15.10 Threat Insights

Solution should include capability to provide actionable insights from custom intelligence offering clear recommendations for mitigation, response strategies, and risk prioritization, empowering an organization to make informed decisions and improve their security posture effectively.

3.16 Service Category 15: Data Security:

Data Security Solutions are designed to protect sensitive information from unauthorized access, loss, or exfiltration. The Solution should monitor data in use, in motion, and at rest, enforcing data protection policies, and detecting any unauthorized attempts to access or share sensitive data. The Solution must integrate with existing security frameworks and support compliance requirements to ensure organizations meet their regulatory obligations.

The Service Category 15: Data Security should provide:

3.16.1 Data Discovery and Classification

Solution should automatically identify and classify sensitive data across the organization’s infrastructure, including databases, file shares, cloud storage, and endpoint devices. The classification engine should apply tags based on predefined policies for data types such

43230000-24-STC Page 18 of 24 as Personally Identifiable Information (PII), financial data, and intellectual property. Enable continuous data discovery to detect new or modified data that requires protection.

3.16.2 Data Loss Prevention (DLP)

Solution should monitor and block unauthorized sharing of sensitive data across multiple communication channels, including email, cloud services, USB devices, and other pathways. Ensure that sensitive data is protected from being copied or moved without proper authorization, with real-time monitoring and alerting capabilities.

3.16.3 Encryption

Solution should ensure that sensitive data is encrypted both at rest and in transit using strong encryption algorithms, such as AES-256. Encryption should be applied to all data stored within the environment and transmitted across the network, ensuring that unauthorized access to data remains unreadable.

3.16.4 User and Entity Behavior Analytics (UEBA)

Solution should analyze how users interact with sensitive data, detecting anomalous behaviors such as copying large amounts of data, accessing restricted files, or sharing data with unauthorized third parties. The Solution should use machine learning to identify insider threats and abnormal data access patterns before breaches occur.

3.16.5 Automated Incident Response

Solution should automate response mechanisms to prevent unauthorized actions, such as blocking sensitive data transfers, issuing alerts, or requiring additional authentication when policy violations are detected. Quarantine suspicious files, block access to certain data, or alert security teams in real-time when DLP policies are breached.

3.16.6 Audit Trails and Reporting

Solution should provide comprehensive audit trails of all data-related activities, including details of who accessed sensitive data, what actions were taken, and when. Generate detailed reports for compliance audits, security evaluations, and incident response investigations.

3.16.7 Compliance Management

Solution should integrate with compliance management platforms to help organizations meet regulatory requirements (e.g., GDPR, CCPA, HIPAA) and provide detailed reporting on data access and protection measures. Ensure organizations can map security controls to compliance frameworks and track any compliance gaps.

3.16.8 Data Catalog and Metadata Management

Solution should provide comprehensive data discovery, search, and metadata management across various data sources within the organization. Metadata management should include data definitions, lineage, quality metrics, and usage patterns to ensure full context for all data assets. Provide tools for data profiling to assess data quality, identify inconsistencies, and maintain data completeness.

3.16.9 Integration with Data Management Tools

Solution should provide seamless integration with ETL (Extract, Transform, Load) tools, data warehousing, and analytics platforms to streamline data processing workflows.

Ensure scalability, enabling the Solution to handle large volumes of data and grow with the organization’s evolving needs.

43230000-24-STC Page 19 of 24

3.16.10 Master Data Management (MDM)

Solution should provide capabilities to create and maintain a single, consistent view of master data (e.g., customer, product, or supplier data) across the organization. Ensure high data quality through robust cleansing, deduplication, and validation tools, while supporting governance frameworks for data ownership and access control.

3.17 Service Category 16: Enterprise Security Log Management, Analytics, and

Response:

Enterprise Security Log Management, Analytics, and Response consists of multiple components that support and provide enterprise security operations, including Security Information and Event Management (SIEM), Security Orchestration, Automation, and Response (SOAR), and backend capabilities for log collection, storage, aggregation and analytics. This service category enables organizations to monitor, detect, and respond to security threats and provide operational visibility across their technology infrastructure.

The Service Category 16: Data Security should provide:

3.17.1 Data Collection and Aggregation

Solution should gather log data from multiple sources, including endpoints, servers, and applications, centralizing them for analysis. It supports structured and unstructured log formats like Syslog and JSON and provides or integrates with cybersecurity analysis solutions (such as SIEM).

3.17.2 Long-Term Data Storage

Solution should provide scalable storage Solutions like data and security lakes and archiving to ensure long-term retention of logs for compliance purposes. This includes cloud and on-premises storage with secure, tamper-proof archiving. Options including long-term/cold storage should be available.

3.17.3 Security Event Correlation

Solution should provide real-time event correlation, detecting complex attacks and anomalies.

3.17.4 Big Data Engine

Solution should process and analyze large volumes of security data in real time. By leveraging distributed computing frameworks this component enables complex threat detection, pattern recognition, and predictive analytics across large data sets. Provide training data sets to reduce false alerts and optimize efficiency of the platform.

3.17.5 Microservices Architecture

Solution should provide a modular approach to security operations, allowing individual services (e.g., log collection, incident response, threat detection) to operate independently. This architecture ensures scalability and flexibility, allowing organizations to adapt to evolving security needs without overhauling the entire system.

3.17.6 Monitoring and Threat Detection

Solution should provide continuous real-time monitoring with customizable alerts and advanced analytics that identify threats using machine…