This document is a set of Questions and Answers related to a Request for Information (RFI) for a Cyber Threat Intelligence (CTI) Aggregation enterprise capability. The RFI is seeking information from industry on a cloud-based solution that can ingest multiple third-party CTI feeds and external threat data to support JFHQ-DODIN's threat analysis and mitigation efforts.
The key details include: JFHQ-DODIN is open to both commercial off-the-shelf and bespoke custom solutions, but does not require IL6 compliance. Vendors are encouraged to provide their solutions' capabilities for features like integrating with commercial and OSINT feeds, handling concurrent users and feeds, supporting data storage and translation requirements, and utilizing AI/ML for threat analysis and visualization. The government has not finalized the acquisition strategy or determined if the award will be limited to small businesses. Responses to the RFI are not limited to small businesses at this time.
The file's text, extracted by GovTribe without its formatting.
Questions
Government Response
1
If this project progresses to RFQ/RFP will the ultimate awardee be a small business?
The government has not yet finalized the acquisition strategy.
2
Does JFHQ-DODIN require an existing commercial SAAS Cyber Threat Intelligence (CTI) Aggregation enterprise (cloud-based) Solution, or do they require a Bespoke custom solution?
Bespoke custom solutions that are also commercial software as a service would be considered.
3
Does JFHQ-DODIN require an offering that is IL6 compliant and has Professional Authorization from DISA for their Cloud offerings?
IL6 is not required for this RFI.
4
Are there a required list of Commercial TI feeds that need to be costed as part of the overall solution?
Vendors are encouraged to provide their solutions ability to integrate with multiple commercial feeds
5
Are there a required list of OSINT feeds that need to be added as part of the solution?
Vendors are encouraged to provide their solutions ability to integrate with multiple OSINT feeds
6
How many users need to have access to the platform, including minimum concurrent user ratio?
Vendors are encouraged to provide their solutions ability to support maximum concurrent user connections
7
How many concurrent feeds does the platform need to be able to simultaneous consume as a minimum? E.G 5 feeds +
Vendors are encouraged to provide their solutions ability to support maximum simultaneous feeds.
8
Are there specific Architectural considerations in terms of Cloud Architecture that need to be considered, mandated certifications, Fed Ramp etc..
No.
9
For Data storage what are the minimum requirements for Hot searchable storage for the Analysts; e.g 6 Months
The government will follow NARA’s records disposition.
10
For Data storage what are the minimum for cold storage capacity and long-term data retention?
Vendors are encouraged to provide data storage fees and capacity.
11
What Classification Levels are required in terms of Platform, are they different levels required as part of the overall platform?
It applies to unclassified and Controlled Unclassified Information (CUI) which is DoD IL5
12
What data formats should this platform accept? Can the Government elaborate on whether the platform should accept video, text, and audio to provide multi-model detection of threats and intelligence from various sources? (Section 3 - Page 2 - Technical Characteristics)
Vendors are encouraged to provide the data formats that they can ingest into their processes.
13
How does the Government anticipate this capability to support/translate across multiple languages to support multi-modal analysis and processing of threat intelligence data from foreign sources? Which languages does the Government view as priority for the platform? (Section 3 - Page 2 - Technical Characteristics)
Vendors are encouraged to provide the ability to translate languages.
14
Can you elaborate on the requirement to "remove unstructured data"? Is the purpose to remove unstructured data once it has been uploaded into the platform or is it to refactor unstructured data into a traditional database? What are the types of unstructured data sources (such as chat logs, blog posts, open source exploits, news outlets, incident reports, vendor advisories, email messages, breach data, etc...) will this platform be required to upload, transform, and store? (Section 3 - Page 2 - Technical Characteristics)
Vendors are encouraged to provide their solutions ability to aggregate unstructured data.
15
Does the Government expect the platform to be built on existing technologies, new technologies, or integrated into existing systems with bolt-on functionality? (Overall)
Vendors are encouraged to provide their solutions ability to utilize modern technologies with the ability to interoperate with a variety of other technologies.
16
What is the Government's anticipated requirement for system progression when the platform necessitates change based on evolution of technology? Has the Government considered a contract structure to account for evolution (e.g., surge)? (Overall)
The Government has not yet developed a follow-on acquisition strategy.
17
In two places your RFI asks questions about using Machine Learning for "Predicative" analysis. To the best of our knowledge, Predicative is not a term used in either Machine Learning or cyber security. Is this intended to read "Predictive"? If the use of Predicative is intended, can the government provide a definition for it's use in this context?
Use this: Predictive analysis is a type of statistical analysis used to make predictions about future events based on historical data. Machine Learning, a subset of Artificial Intelligence, can be used to build predictive models by training algorithms on historical data and using them to make predictions about new data.
18
One of the capability descriptors asks about the ability for "machine learning to display threat levels". Generally, a machine learning model would be used to predict something, such as classifying the severity of a threat based on its attributes. Then, based on that ML model output (e.g. this is a high, medium, or low threat) that classification could be visually displayed in a user interface (e.g. red, yellow, green). Can the government confirm or clarify; is the intended meaning of this phrase that (1) a machine learning model classify or otherwise score threats, and then (2) the SaaS application provide for the visualization of that output?
The government is asking the vendors to provide their solutions’ characteristics as they exist or can be developed concerning AI/ML scoring and visualization.
19
The RFI talks about corelating and alerting the Indicators of Compromise (IOC’s) which will originate from the Cyber Threat Intelligence data. Can you elaborate on this use case? Will you be corelating this to actual telemetry data (eg. NetFlow, DNS, EDR etc?) within the network? Is that included in the current scope, and if not, should it be?
Yes.
20
One of the critical factors to having a resilient cyber security framework is the ability to identify threats quickly and assess the extent of the damage it has caused across the organization so you can provide the necessary remediation to fix the known vulnerabilities in a timely manner. In either of these cases "speed to insight at scale" becomes extremely important. Can you give us an idea of what the volume of data you are looking to analyze? A rough estimate on overall scale, terabytes, petabytes etc. would be helpful.
Not required.
21
The RFI discusses removal of duplicate and redundant data - does this relate to getting the same Threat Intelligence from multiple sources and removing duplications or is it referring to something else?
Yes.
22
How is the customer planning on maintaining custody of their data in an "as-a-Service" solution for this effort rather than deploying in the customer's cloud tenant?
The SAAS data should be maintained within the application.
23
What type of access control approach is the customer intending proposers to implement to ensure data integrity and reduce data leaks?
This is not part of the RFI requirement, at this time. Vendors are welcomed to provide access control methodology and approaches.
24
What type of encryption is the customer intending with regards to data at rest or in transit? Is there value in a solution for performing range-based queries on encrypted data while utilizing a client-side encryption approach?
This is not part of the RFI requirement, at this time. Vendors are welcomed to provide encryption methodology and approaches.
25
What sorts of key performance parameters is the customer considering for this effort? Would response times for queries/analysis in milliseconds improve analysts' workflows?
Vendors are encouraged to provide measurable performance parameters in response to the RFI.
26
Is this RFI response limited to only Small Business submissions?
No.
27
Is there any consideration of opening the follow-on awards to large business vendors?
The government has not developed the follow-on acquisition strategy.
File details come from the government source that posted it.
Updated .
Defense Information Systems Agency