Attachment 1 Questions and Answers.pdf

Section/ Paragraph/ Text Page

Number Question/Comment/Recommendations Government Response “Include a Rough Order of Magnitude over a five-year lifecycle. Include training, installing, software license, maintenance, tracking system, and any other costs. If your solution includes only the software licenses and maintenance that information would also be valuable.”

Vendor question: What sizing estimate of IP's and/or Devices is available for the software licensing?

Estimated 11 million devices across DoD.

“How would your company establish operations support for the Program Office to include business critical support (24x7) (i.e. manpower required to deploy, support, train Program Office staff, assist with training for customers, product support plan)?”

Vendor Question: Is the assumption that the current ACAS support contract with ATS would remain as a separately funded contract?

Correct

“Companies who wish to respond to this RFI should send responses via email no later than 5 p.m. EDT on April 24, 2025”

Vendor Question: Would it be possible to grant an extension?

Yes, this can be extended to May 2, 2025.

For the “HIGH” requirements sheet in the Excel template, we noticed there is no column for “Does Meet / Does Not Meet,” unlike the “CRITICAL” requirements sheet. Are we permitted to modify the template to add this column for consistency and clarity in our submission?

Yes, that is permissible.

In several instances, OFFEROR partially meets a capability (e.g., through integration or by covering most—but not all—aspects of the requirement).

Would you prefer we:

Mark these as “Does Not Meet” with clarifying notes, or Break the requirement into sub-capabilities to reflect partial/majority coverage more accurately (e.g., 80% met natively, 20% via partner/tooling)?

Please make as Does Not Meet with clarifying notes.

Would you accept a multi-vendor solution if it is able to meet most, if not all, of the listed requirements?

Yes, but it is preferred if the offeror can bundle the solution into a single cost for the DoD.

RFI - 842571649 - Question & Answers

Do you require any supplemental documentation (e.g., white papers, diagrams, system descriptions) to accompany the initial submittal?

No additional documentation will be provided.

Will there be a requirement for a technical demonstration of capabilities? If so, what is the expected timeline post-submittal, and will key topics or functional areas be shared in advance with vendors?

There will not be a requirement for a technical demonstration. However, after evaluation is completed, the Government may reach out to certain vendor for more information which may include requests for technical demonstration.

Will vendors have the opportunity to propose alternative solutions or methodologies that differ from legacy approaches but still meet or exceed the original scope?

Yes, as long as the proposed solution meets the requirements.

Are there specific regulatory approvals or certifications (e.g., DoD IL5, IL6, FedRAMP High, NIST 800-53) that vendors must already meet prior to consideration? Will waivers or provisional approvals be considered for vendors actively pursuing certification?

Nothing is required, but if a vendor has regulatory approvals or certifications that would reduce the time for DoD to implement a solution please include that in your response.

Will future-ready or roadmap capabilities—i.e., those not currently available at time of submittal but expected to be production-ready in the near term—also be considered? If so, are there specific criteria DISA will use to assess their viability?

Please address those roadmap capabilities in the spreadsheet. For example, if you do not meet the requirement at this point in time, you may include additional information how/when the requirement will be satisfied at a later time.

Of the 11 million devices anticipated for scanning, how many are expected to be IoT versus OT? A breakdown by device type or category would help us align sensor coverage appropriately.

At a high level DoD does not have an accurate picture of the OT/IOT assets that are connected to the DoD information Network. For estimation purposes, would recommend using 2-4 million for IOT/OT, but include per license costs and an understanding of how many licenses can be purchased for cost volume discounts apply.

For OT device scanning, are cloud-connected management and analytics platforms acceptable, or must the entire solution remain fully on-premises or within an IL5/6 enclave?

The Government is seeking a hybrid solution that could operate in cloud and on premise.

Can PMO clarify what you mean by: “- Discuss the management support for the entire enterprise?” What is “management support”? And what is the “entire enterprise”

DoD is comprised of over 40 individual components with several million assets and resources to manage cyber security solutions. Please describe how you as a vendor or a team of vendors could support the collective DoD operationally. (i.e. Help desk, documentation, lessons learned, Tactics, Techniques and Procedures (TTPs), operational support, etc.) This includes tactical environments as well as traditional enclaves. Examples of large scale deployments would be beneficial to the evaluation.

Is DISA looking for a cloud solution, hybrid, or strictly on premise solution? The current solution is on-prem, but the Government is interested in a hybrid solution and information on how DoD can gradually implement to cloud environments.

Does the requirement to import and export data in accordance with SCAP standards imply a requirement to assess networks and devices for their SCAP compliance?

The solution should be SCAP compliant.

How many of the estimated 11 million devices do you anticipate to be OT assets?

Recommend using 2-4 million for OT/IOT assets.

Will the Government consider extending the response deadline from 4/24 to 5/2 so we may prepare an adequate and thorough response?

Yes that extension is appropriate.

7.14 Can you elaborate more on “tiered hierarchical assessment” capability? DoD has many components, sub-components, etc. Please describe if/how your solution can operate across DoD with a diverse makeup of hierarchies.

7.14.2 Does COAMS have an API? Or, how is COAMS data expected to be consumed? Yes COAMS has an Application Programming Interface (API).

5.1 Does remote refer to both connected and/or disconnected assets. I.e. SCADA networks or other OT environments? (isolated, airgapped, etc)

Yes, all of the above.

5.1 Are there uplink or bandwidth limitations applicable to the network for the OT or IoT assets?

The proposed solution will support DoD tactical environments and solutions should be able to operate on bandwidth constrained networks. Some networks can only support KBs of data. Please describe if data transmitted can be throttled.

5.1 Are there uplink or bandwidth limitations applicable to OT or IoT assets themselves?

The proposed solution will support DoD tactical environments and solutions should be able to operate on bandwidth constrained networks. Some networks can only support kilobytes (KBs) of data. Please describe if data transmitted can be throttled.

5.1 Does agentless discovery require low to no impact probing and analysis with the ability to enumerate and fingerprint devices without credentials?

No, but the less stress on the network and network devices is preferred and will be taken into consideration.

5.1 Does the requirement for non-agent based assessment of devices require active enumeration to discover gaps that passive monitoring is incapable of discovering?

Please explain limitations of the tool you are proposing. DoD needs to be able to discover all assets regardless of whether the solution is passive or active.

5.1 Are hardware appliances that must be inserted into the OT or IoT environment considered agent based?

No, but HW appliances will be considered.

RFI+ACAS+.pdf Document Page 1 and 2 Overview Section, states “Sustains what the DoD already has on premise” Scope Section states “suitable product candidates for replacement of ACAS” Is maintenance of outgoing solution architecture and outgoing network appliances to be the responsibility of awardee through the transition to a next-solution set?

No, but any vendor proposing a new solution should understand the current solution, how it supports the DoD and how the new implementation will sustain baseline.

ACAS+3+Requirements+RFI.xls Sheet Tab - Critical 7.27

Is the external subscriber CMRS or something else? CMRS is the primary, but DoD components have other data aggregation solutions that may be utilized within their organizations.

RFI+ACAS+.pdf Document Page 2 - Scope Section

Does DISA desire a single stand-alone solution that meets all requirements or would DISA desire a solution which augments current DISA and Services technology investments to reduce costs?

The less items administrators have to learn, deploy, operate and sustain is always preferable, but DoD is also looking at ways to be more efficient and reduce costs. As long as requirements can be met to achieve the mission goals either approach is acceptable.

RFI+ACAS+.pdf Document Page 1 - Overview Section

11 Million devices assumes all of DoD. Please confirm that ACAS replacement is for all DoD and not just DISA 4th Estate?

This RFI speaks to a DoD implementation.

RFI+ACAS+.pdf Document Page 1 - Overview Section

Will DISA select a single solution or multiple solutions that meet the requirements allowing services to select technologies appropriate for their mission and network architecture?

A single solution is preferred, but if the vendor is proposing multiple solutions to meet all requirements, please do so to allow the PMO to evaluate.

To provide accurate ROM pricing we need more information about the environment - roughly how many cloud workloads will be part of the environment?

The tenant count of the entire DoD is unknown. Please provide costs for an Enterprise offering.

We’re observing a potential gap in requirements educated by experience with the broader industry and government: can you provide your interest in assessing vulnerabilities and gaining visibility in the code, building, and delivery of applications across the software delivery lifecycle?

Please include any additional features your solution may address on top of meeting the baseline requirements.

We don’t observe broad requirements around threat detection: actions involved in identifying suspicious and unusual activities within an environment, typically based on logs and events. Is there interest in this capability to provide a more threat-ready security model?

Please include any additional features your solution may address on top of meeting the baseline requirements.

These requirements seem to be oriented towards only personnel in security operations. Would there be interest in user experiences that enable developers and cloud operations personnel to provide faster mean time to resolution (MTTR) and more intelligent prioritization for threats and issues?

Please include any additional features your solution may address on top of meeting the baseline requirements.

Have you determined a threshold for scoring CVEs? Some solutions we’ve observed in the marketplace only score approximately 70% of CVEs, meaning 30% of CVEs are discarded from prioritization calculations?

No, but it would be beneficial if a solution identified and prioritized critical threats for operators to address soonest.

Is there interest in risk scoring methodologies that correlate with other security insights? For example, mapping out attack paths and lateral movements of vulnerabilities across network and teams.

Yes

Are you considering utilization of newer technologies such as serverless containers? Will these capabilities require scanning and inventory capabilities as well?

Yes to both.

Are you considering event-triggered scanning in addition to the automated requirements listed?

Please include any additional features your solution may address on top of meeting the baseline requirements.

Is there interest in secure auto-remediation or clear remediation guidance for vulnerabilities and toxic combinations such as lateral movements and network attack paths?

Please include any additional features your solution may address on top of meeting the baseline requirements.

We are observing only a few requirements explicitly calling out Cloud. Is there interest in correlating security events and alerts across different cloud providers to provide a cohesive security strategy

Yes.

We are noticing many requirements around scanning for installed applications and software for but no mentions about whether these applications are being detected in runtime. We are finding in the industry that having this piece of data, whether the application is detected as actively running on the machine, is critical for prioritizing vulnerabilities and issues. Does that align with your expectations?

Yes.

1.24 The system shall identify, track, and maintain "system identity" uniqueness during assessments and data management ensuring the changes within the authoritative record are flagged when changes to the system's identity are discovered. Q: Are there technical references defining “system identity” uniqueness? Please clarify this term.

Please describe if/how your solution tags an asset so that it can always be identified if removed from the network, assigned a different IP, has multiple IPs, etc. What combination of attributes does your solution use so the DoD knows that Server or Laptop X can be always be found as such.

4.16 The system shall provide a capability to perform website assessments. Q: Can you provide technical references defining a “website assessment”?

Please describe your solution’s web application scanning capabilities.

4.18 The system shall provide a capability to provide assessments against Windows 32 bit operating systems. Q: Does the environment have 32 bit operating systems in cloud environments? Are 32 bit operating systems going to continue their lifecycle as they are moved to cloud environments?

The Government may maintain antiquated technologies for an undetermined period of time.

4.2 The system shall provide a capability to provide assessments against UNIX operating systems. Q: Can you state what UNIX Operating Systems that are intended to support?

Please describe all Operating systems that your product can support.

4.24 The system shall provide a capability to assess DoD IAVM Notice compliance with IAVM compliance reported per specific product version and/or patch. Q:

Can technical references be provided for the systems providing DoD IAVM Notice compliance?

No additional details will be provided.

7.14.2 The system shall provide the ability to ingest COAMS and update hierarchies to match, including deletions, display name changes and parent/child changes Q:

We could not find a declared, public definition for a COAM. Please advise on this acronym.

Cyber Operational Attribute Management Solution.

7.27 The system shall provide a capability to support replication of detailed per-asset findings to external subscribers using an XML Schema that can export all collected data and be transformed to DoD or NIST standards using Stylesheets.

Q: Can you point us to a technical reference for this XML schema and stylesheets intended to be utilized?

Please describe how your solution exports data and how long it would take for new requirements to be developed.

7.28 The system shall provide the capability to collect applicable data elements of the DOD Master Device Endpoint Record (MDER) and export the data to external systems through the use of APIs, JSON data exports, and/or XML data exports per 7.27 above Q: Can you provide a versioned technical reference containing the required the data elements of the DOD Master Device Endpoint Record (MDER) so we can validate our API export elements against it?

See Attachment 1, Master Device Endpoint Record (MDER)

13.23 The system shall be configurable to receive updates exclusively from a DoD-specified site. Q: Can we get a versioned technical reference as to the DoD-specified sites and the data modalities of how the updates are intended to be distributed?

Please propose a solution on how to update your device or product across DoD.