Addendum No. 01 with Written Inquiry Responses

DCF RFI 2627 008

DIGITAL PRIVACY PROTECTION SERVICES

Solicitation Number:

Solicitation Title:

Response(s) Due Date:

Addendum Number:

DCF RFI 2627 008

Digital Privacy Protection Services 07/29/26

Addendum Date: 7/16/26

DCF RFI 2627 008 is hereby amended as follows, all other terms and conditions of the solicitation remain in effect. All additions are highlighted in yellow, and words stricken are deletions:

Change No. 01

Section 6. Timeline

EVENT DATE TIME LOCATION

Release of RFI June 16, https://vendor.myfloridamarketplace.com/

Submission of Questions June 30, 10:00 a.m. Section 7

Department’s Response to Questions

July 8

July 16, Section 7

Responses Due July 22 July 29, 10:00 a.m. Section 3

Presentations, if applicable

TBD TBD

The responses provided below are intended solely to clarify the Department's current market research objectives for this Request for Information (RFI). Nothing contained in these responses shall be construed as establishing mandatory requirements, evaluation criteria, or contractual obligations for any future solicitation.

Any future procurement requirements will be identified in the applicable solicitation, if issued.

See below the Department’s responses to written inquiries:

https://vendor.myfloridamarketplace.com/

DIGITAL PRIVACY PROTECTION SERVICES

Response to Written Inquiries:

Question

Vendor Name

Solicitation Section

Question Department Response

1 Endictus Corp.

For planning purposes, can the Department provide an estimated number or range of covered personnel expected to receive services under an initial implementation, as well as any anticipated maximum population if the program is expanded statewide or enterprise-wide?

The Department has not finalized the estimated number or range of covered personnel for any future procurement.

Respondents should provide flexible assumptions that support pilot, phased, role-based, risk-tiered, and larger-scale deployment scenarios. Respondents should also describe minimum enrollment volumes, scalability limits, administrative impacts, and pricing assumptions at different enrollment levels.

2 Endictus Corp.

Is the Department considering coverage for household members or immediate family members in addition to covered personnel? If so, how should vendors define eligible family or household members for planning and pricing purposes?

The Department has not finalized whether coverage will include household members or immediate family members in addition to covered personnel. Respondents should describe their ability to support employee-only coverage, household coverage, immediate family coverage, and enhanced High- Value Target / Executive / Family coverage where appropriate. Any family or household coverage should address consent, enrollment, privacy, data minimization, identity verification, minor-child considerations, administration, and pricing.

3 Endictus Corp.

Does this requirement fall under a current protection program, or will a protection program be created to manage it?

The Department is using this RFI for planning and market research purposes to understand available digital privacy protection and online personal information removal capabilities. Respondents should describe how their solution could support a new or evolving enterprise-grade capability, including how it may operate independently or complement existing security, privacy, reporting, alerting, and workflow functions.

4 Endictus Corp.

What enrollment approach does the Department anticipate: employee self-enrollment, Department-administered bulk enrollment, or a combination of both?

The Department has not finalized the enrollment approach.

Respondents should describe support for employee self-enrollment, Department-administered enrollment, bulk enrollment, and hybrid enrollment models. The Department prefers approaches that reduce Department handling of sensitive personal information where feasible, while maintaining appropriate consent, authentication, role-based access, audit logging, reporting, and oversight.

5 Endictus Corp.

Does the Department want respondents to address exposure originating from public records or government-published sources in addition to data brokers, people-search websites, search engines, social media platforms, and other online sources?

Yes. Respondents should address exposure originating from public records or government-published sources in addition to data brokers, people-search websites, search engines, social media platforms, dark web sources, criminal markets, and other online sources. Respondents should clearly distinguish between information that can be removed, suppressed, de-indexed, monitored, escalated, or reported as residual risk due to legal, technical, public-record, jurisdictional, or third-party limitations.

6 Endictus Corp.

What data elements does the Department anticipate providing or allowing vendors to collect for enrollment and exposure analysis, such as names, aliases, prior addresses, phone numbers, personal emails, family member names, or other identifiers?

The Department anticipates that any data collected or provided for enrollment and exposure analysis would be limited to the minimum necessary to perform the service.

Respondents should identify the data elements required for their solution to perform enrollment, exposure discovery, monitoring, removal, suppression, and reporting.

The Department prefers approaches that reduce Department handling of sensitive personal information where feasible, such as secure self-service enrollment by covered personnel, with appropriate consent, authentication, encryption, audit logging, role-based access control, retention limits, and deletion procedures.

Respondents should clearly distinguish between required and optional data elements and describe how all collected information will be protected, used, retained, and disposed of.

The Department does not intend to authorize unnecessary collection of sensitive identity documents, biometric-like images, or family member information unless clearly justified, consented to where appropriate, and protected by strong security and privacy controls.

7 Endictus

Given Florida public records requirements, does the Department prefer that vendors avoid including sensitive screenshots, sample exposed personnel data, detailed security diagrams, or proprietary methodologies in the public version of the RFI response, and provide such material only in a clearly marked confidential version if necessary?

Yes. Vendors should avoid including sensitive screenshots, sample exposed personnel data, detailed security diagrams, exploit paths, credentials, protected personal information, or proprietary methodologies in the public version of the RFI response. For planning purposes, respondents should provide enough detail to evaluate service capability, security posture, and operational feasibility without unnecessarily exposing sensitive personnel information, agency security information, or proprietary implementation details.

8 Endictus

Which capabilities does the Department view as core or highest priority for a future procurement, such as dedicated doxxing mitigation services, data broker removal, people-search website suppression, social media exposure mitigation, impersonation monitoring, search engine result reduction, continuous monitoring, urgent escalation support, reporting, training, etc?

The Department views the highest-priority capabilities as those that reduce safety, privacy, fraud, impersonation, and doxxing risk for personnel in high-risk or sensitive roles. For purposes of this RFI, respondents should describe their ability to provide an integrated and enterprise-grade service.

Core Capabilities include:

• Doxxing mitigation

• Data broker removal

• People-search website suppression

• Continuous monitoring

• Impersonation monitoring

• Search engine result reduction

• Urgent escalation support

• Reporting and dashboards

• Case management and evidence tracking

• Privacy and security controls

• Training and awareness

Respondents should clearly identify which capabilities are included in the core service, which are optional or enhanced services, and which are limited by third-party platform policies, public records law, international jurisdiction, search engine rules, or other legal or technical constraints.

The Department understands that complete removal of all exposed information from every online source may not be achievable. Respondents should therefore explain realistic effectiveness, expected limitations, recurrence management, escalation options, and any compensating protections available when removal is not possible.

9 Endictus

Are there specific security certifications, compliance frameworks, hosting standards, or personnel vetting requirements the Department anticipates requiring or preferring in a future procurement, such as SOC 2 Type II, CJIS, ISO 27001, CMMC C3PAO, FedRAMP, NIST Cybersecurity Framework, or comparable standards?

At a minimum, the Department is required to adhere to NIST SP 800-53 Rev. 5, NIST Cybersecurity Framework, CJIS Security Policy, ARC-AMPE, IRS Publication 1075, and Florida Administrative Code Rule 60GG-2, as applicable to the final scope of services, data types, hosting model, and system integrations.

Respondents should describe how their solution, hosting environment, personnel practices, subcontractors, and operational controls align with these requirements.

10 Access IT Group

The requirements of this RFI recognize the risk and concern of PII data being exposed on data broker sites, as well as the Dark web. Given that no vendor or partner can completely remove PII from data broker sites and dark web data can never be fully removed (some level will always exist):

a. Does this RFI include a requirement for recurring/any home network scanning/penetration testing for users? Home networks and devices are at least 25% more likely to have experienced some level of compromise.

b. Should the solution include any level of hardening for users’ home devices (phone, laptop, tablet, etc.)?

From our experience, approximately 87% of users had no security on their phones or laptops prior to working with us.

No. The RFI is focused on digital privacy protection services related to exposed personal information, doxxing risk, data broker removal, people-search suppression, impersonation monitoring, dark web exposure awareness, monitoring, reporting, and related remediation support. It does not establish a core requirement for recurring home network scanning, home penetration testing, or security testing of personally owned networks or devices.

The Department recognizes that exposed PII, dark web exposure, weak personal-device hygiene, and home network risk may be related in practice. However, scanning or testing an employee’s personal home network, phone, laptop, tablet, router, or other personally owned technology introduces separate privacy, consent, liability, labor, support, and data-handling considerations.

Respondents may identify home network security review, personal device security guidance, mobile device hardening, endpoint configuration assistance, or cybersecurity concierge support as optional or value-added capabilities, but such services should be clearly separated from the core digital privacy protection scope.

The Department’s priority is to reduce personal information exposure and associated safety, privacy, impersonation, and fraud risks for covered personnel. Respondents should therefore distinguish between core privacy exposure reduction services and any optional personal cybersecurity hardening services that may complement, but not replace, the primary RFI objectives.

11 Access IT

It is noted in the RFI to describe a staffing model and whether services are performed within the United States.

Does this mean that there is a requirement for a 7x24 US SOC staffed with US resources?

No. The reference to staffing model and whether services are performed within the United States does not, by itself, establish a requirement for a dedicated 24x7 U.S.-staffed Security Operations Center for this RFI.

The Department requires that access to agency data be from United States, Canada or Puerto Rico and that any agency data remain geographically fenced to these regions.

The Department is requesting that respondents describe their staffing model, support locations, operational coverage, escalation process, and whether any services are performed outside the United States. This information will help the Department evaluate operational risk, data protection, response capability, and alignment with applicable requirements, including NIST SP 800-53 Rev. 5, NIST Cybersecurity Framework, CJIS, ARC-AMPE, IRS Publication 1075, and F.A.C. 60GG-2, as applicable.

12 Access IT Group

Are there any requirements for a cybersecurity concierge service to assist users?

a. If so, can you please describe any specific requirements needed?

b. Are US resources also required for this service?

The RFI does not establish a mandatory requirement for a cybersecurity concierge service at this stage. However, respondents may describe cybersecurity concierge, privacy support, or user-assistance services as optional or value-added capabilities that may complement the Department’s digital privacy protection objectives.

The Department prefers support models that minimize risk to covered personnel and reduce administrative burden on Department staff while preserving appropriate security, privacy, and oversight controls.

13 Access IT

What level of involvement and information is required from the department?

a. Does the department require an organizational level dashboard with anonymized metrics of enrollment, statistics, usage, and adoption levels?

The Department is interested in dashboard and reporting capabilities that support both operational case management and executive-level oversight. Respondents should describe dashboards, alerts, reports, metrics, and case management workflows available to the Department, including whether reporting can be aggregated, anonymized, role-based, and exportable.

Metrics of interest include enrollment status, adoption rates, exposure findings, source categories, severity levels, removal activity, suppression activity, time-to-removal, recurrence rates, unresolved findings, urgent escalations, support activity, service effectiveness, and vendor performance against service levels.

The Department is particularly interested in reporting that demonstrates measurable risk reduction over time rather than activity counts alone. Respondents should distinguish between findings identified, removal requests submitted, removals verified, suppressions completed, items pending third-party action, and items that cannot be removed due to legal, technical, platform, public-record, or jurisdictional limitations.

Dashboards should protect sensitive personal information through role-based access control, multi-factor authentication, encryption, audit logging, data minimization, and least privilege access. Organizational reporting should be aggregated or anonymized where feasible, with individual-level details limited to authorized users with a defined need to know. The Department may define specific reporting, dashboard, performance, and service-level requirements in a future solicitation based on final scope, data sensitivity, implementation model, and operational risk.

14 Access IT

Does this need to be a one size fits all solution for all personas noted, or will there be features that are only considered for certain personas verses others?

No. The Department does not anticipate that a future solution must be limited to a one-size-fits-all model. For purposes of this RFI, respondents should describe whether their solution supports a common baseline service for all covered personnel, as well as optional or enhanced capabilities that may be applied based on role, risk profile, exposure level, threat condition, family or household exposure, or operational need.

The RFI is focused on Department personnel occupying high-risk or sensitive positions and identifies privacy and safety risks associated with residential addresses, telephone numbers, family associations, photographs, social media references, and other identifying information exposed through online sources. It also asks respondents to describe experience supporting child protective investigators, law enforcement personnel, public sector investigators, attorneys, judges, and other high-risk government employees.

Respondents should clearly state which features are included in the core service, which are optional, and which are recommended only for specific personas or elevated-risk use cases. The Department is particularly interested in flexible, scalable service models that can adapt to different personnel categories and risk levels.

15 Incogni What is the estimated or baseline number of "covered personnel" occupying high-risk or sensitive positions that the Department anticipates needing these services for?

Refer to the Department’s response to Question #1.

16 Incogni Does the Department expect to onboard all personnel simultaneously, or will there be a phased rollout approach?

The Department has not finalized the onboarding approach.

Respondents should describe their ability to support phased rollout, pilot deployment, bulk enrollment, secure self-service enrollment, and expansion by role, risk tier, or operational need.

17 Incogni Does the Department intend to extend these privacy protection services to the immediate family members/household members of the high-risk personnel, or will coverage be restricted strictly to the employees themselves?

Refer to the Department’s response to Question #2.

The Department is particularly interested in flexible, risk-based service models that can support different coverage levels without creating unnecessary administrative burden or excessive collection of sensitive personal information. Any family or household coverage should be treated as a configurable or optional capability unless expressly required in a future solicitation.

18 Incogni If selected for presentation, will the presentation be virtual or will attendance be required in Florida?

Presentations, if requested, will be at the sole discretion of the Department. The Department may determine whether presentations are virtual, in-person, or hybrid at a later date.

19 Incogni What is the anticipated timeframe or window for these presentations following the July 22, 2026 response deadline?

The timeframe for presentations has not been finalized.

Presentations, if applicable, will be scheduled at the sole discretion of the Department after review of RFI responses.

20 Incogni Will the Department require the selected vendor to integrate its services or dashboards with any existing internal IT systems, identity management platforms, or case management software currently used by the Department?

For planning purposes, the Department anticipates that a future solicitation may require compatibility with core enterprise technology and security functions, including Identity and Access Management, alerting and notifications, reporting, ticketing/workflow, and security logging.

The Department is not identifying specific internal systems for integration at this RFI stage. Respondents should therefore clearly distinguish between:

1. Required platform compatibility needed to support enterprise operations and oversight;

2. Optional direct integrations that may improve efficiency or automation; and

3. Dependencies that would be necessary for full implementation.

Any integration or compatibility approach must support data minimization, encryption in transit and at rest, MFA, role-based access control, least privilege, auditability, secure logging, retention limits, and secure deletion. Respondents should also describe how integration data would be protected, monitored, retained, and restricted to authorized personnel.

21 Incogni Is there an estimated project start date or a target go-live date for when the Department hopes to have these privacy services actively deployed for personnel?

The Department has not established a target project start date or go-live date. Any future implementation timeline may be determined through a subsequent solicitation, funding availability, operational readiness, and procurement requirements.

22 Incogni Is the Department currently utilizing a digital privacy or online personal information removal service, or is this a brand-new initiative?

The Department is using this RFI for market research to understand available digital privacy protection and online personal information removal capabilities. Respondents should describe how their solution could support a new or evolving enterprise-grade capability.

23 Incogni For the general pricing ranges requested in Tab 3, does the Department prefer to see pricing modeled on a per-user/per-month basis, tiered bulk enrollment brackets, or an annual enterprise-wide license structure?

For planning purposes, respondents may provide general pricing information using per-user, subscription, tiered service level, pilot, enterprise, or other pricing models. Pricing should be non-binding and should clearly identify assumptions, cost drivers, optional services, and scalability factors.

24 Infoblox Scope and desired outcome

Can you clarify whether your primary need is broad personal information removal from data brokers and people-search sites, fraud-focused digital risk protection, or both?

Both. The Department’s primary need is an integrated digital privacy protection capability that addresses broad personal information exposure reduction and fraud-focused digital risk protection for Department personnel occupying high-risk or sensitive positions.

The RFI specifically seeks information on services that can identify, monitor, suppress, and/or remove publicly accessible personal information from online sources, including search engines, people-search websites, data brokers, and similar sources. It also identifies capabilities such as online personal information removal, data broker opt-out management, people-search website suppression, social media exposure mitigation, impersonation monitoring, search engine result reduction, and digital privacy monitoring.

The Department understands that complete removal of all exposed information from every source may not be achievable, particularly for dark web data, offshore sources, cached content, archived pages, public-record-derived content, or platforms outside the vendor’s control.

Respondents should therefore clearly describe their realistic capabilities, limitations, recurrence handling, escalation options, and compensating controls.

The Department is particularly interested in enterprise-grade solutions that can combine privacy exposure reduction, digital risk monitoring, urgent escalation, auditable reporting, and scalable operational support without requiring unnecessary collection or retention of sensitive personal information.

25 Infoblox Scope and outcome

When you reference online personal information removal, which data types are in scope: home addresses, phone numbers, family associations, photographs, social media references, emails, or other identifiers?

Respondents should describe their ability to identify, monitor, suppress, remove, escalate, or otherwise mitigate exposure involving the following data types and sources where legally and technically feasible:

• home addresses

• phone numbers

• personal email addresses

• family or household associations

• photographs

• social media references

• employment or role references

• aliases or name variants

• search engine results

• dark web exposure

• credentials

• personal identifiers

• contact information

• breach data

• threat chatter, or exposed records associated with covered personnel

• criminal market exposure

• information listed, traded, sold, bundled, or discussed in criminal forums

• illicit marketplaces

• credential markets

• fraud-enablement channels or doxxing repositories

• other identifiers

• other data elements that could reasonably enable targeting, impersonation, fraud, harassment, extortion, or doxxing.

26 Infoblox Scope and desired outcome

For search engine result reduction, are you looking only for removal or suppression of fraudulent or impersonating content, or also legitimate but sensitive public-record or indexed content?

The Department is interested in search engine result reduction for both fraudulent or impersonating content and legitimate but sensitive public-record or indexed content, where legally and technically feasible.

27 Infoblox Scope and outcome

Should coverage include employees only, or also spouses, family members, and other household members?

Refer to the Department’s response to Question #17.

28 Infoblox Scope and desired outcome

Are you seeking protection mainly for executives and VIPs, or for all high-risk personnel categories listed in the

RFI?

The Department is not seeking protection only for executives or VIPs. The RFI is focused on Department personnel occupying high-risk or sensitive positions, which may include executives or highly visible personnel, but also includes other personnel whose duties may create elevated privacy, safety, fraud, impersonation, or doxxing risk.

The RFI specifically asks respondents to describe experience providing services to populations such as child protective investigators, law enforcement personnel, public sector investigators, attorneys, judges, and other high-risk government employees.

29 Infoblox Scope and desired outcome

Is a pilot acceptable, or are you expecting an enterprise-scale program from day one?

A pilot or phased approach may be acceptable. Respondents should describe how their solution can support an initial controlled deployment while also scaling securely and operationally for larger enrollment levels if pursued later.

30 Infoblox Service model and operations

Are you looking for a managed service, a self-service platform, or a hybrid model?

The Department is interested in understanding managed service, self-service, and hybrid models. The Department prefers models that minimize administrative burden while preserving oversight, security, privacy, reporting, and auditability.

31 Infoblox Service model and operations

What service levels or escalation expectations do you have for urgent threats involving judges, investigators, attorneys, or other at-risk personnel?

For purposes of this RFI, respondents should describe their service levels and escalation capabilities for urgent privacy, safety, impersonation, fraud, doxxing, or exposure events involving at-risk personnel. The RFI specifically requests information regarding customer support availability and escalation procedures for urgent safety concerns.

Severity Level Example Event Critical / Urgent | Active doxxing, credible threat, impersonation tied to fraud or harassment, exposure of home address for a high-risk individual, criminal market or dark web exposure with immediate risk indicators, rapid intake, priority triage, urgent notification to the Department, immediate mitigation steps, evidence preservation, case tracking, and executive escalation.

High | Sensitive personal information newly discovered or republished, family or household exposure, high-risk data broker or people-search exposure, concerning social media exposure, prompt validation, removal or suppression workflow, Department notification, documented action plan, and recurring status updates.

Moderate | Non-urgent personal information exposure, routine recurrence, lower-risk indexed content, standard opt-out or suppression request, standard case creation, remediation workflow, tracking, reporting, and recurrence monitoring Informational | General exposure trend, non-actionable dark web indicator, low-confidence match, user education issue, Reporting, monitoring, user guidance, and inclusion in periodic metrics.

Respondents should identify their available response targets for each severity level, including time to acknowledge, time to triage, time to first action, time to Department notification, time to escalation, time to verified removal or mitigation, and frequency of status updates.

The Department is particularly interested in urgent-response models that include:

Rapid escalation| Ability to escalate urgent threats involving investigators, attorneys, executives, law enforcement-adjacent personnel, or other at-risk personnel 24x7 options.

Availability of after-hours or 24x7 escalation for critical safety-related events, U.S.-based support, identification of whether urgent response personnel are U.S.-based and whether any offshore resources have access to sensitive information, evidence preservation | screenshots, URLs, timestamps, source details, action history, and chain-of-custody-style documentation where appropriate.

Case management | ticketing, assignment, severity, status, notes, closure reason, recurrence tracking, and Department action items.

Alerting and notifications | Secure alert routing to authorized Department contacts for urgent events.

Security logging | Audit logs for access, actions taken, administrative activity, and sensitive data handling.

Executive reporting | aggregated and anonymized metrics for leadership visibility and oversight.

Recurrence monitoring | re-checks for republished, re-indexed, or reappearing exposure after initial removal or mitigation.

The Department expects respondents to distinguish between actions that can be taken immediately, actions dependent on third-party platforms, actions limited by law or jurisdiction, and residual risks that can only be monitored or escalated.

Complete removal may not be possible in all cases, especially for dark web data, criminal markets, cached pages, archived content, offshore sources, public-record-derived content, or third-party-controlled platforms.

The Department may establish specific mandatory service levels, escalation timelines, notification procedures, and support requirements in a future solicitation based on final scope, covered populations, risk tiers, operational needs, and data sensitivity.

32 Infoblox Service model

Do you expect continuous monitoring and recurring removals to be included in the core service?

For planning purposes, respondents should describe whether continuous monitoring and recurring removals are included within their core service offering.

33 Infoblox Service model and operations

What reporting outputs are most important to you: dashboards, alerts, case tracking, time-to-removal metrics, recurrence reporting, or executive summaries?

The Department is interested in dashboard and reporting capabilities that support both operational case management and executive-level oversight. Respondents should describe dashboards, alerts, reports, metrics, and case management workflows available to the Department, including whether reporting can be aggregated, anonymized, role-based, and exportable.

Metrics of interest include enrollment status, adoption rates, exposure findings, source categories, severity levels, removal activity, suppression activity, time-to-removal, recurrence rates, unresolved findings, urgent escalations, support activity, service effectiveness, and vendor performance against service levels.

The Department is particularly interested in reporting that demonstrates measurable risk reduction over time rather than activity counts alone. Respondents should distinguish between findings identified, removal requests submitted, removals verified, suppressions completed, items pending third-party action, and items that cannot be removed due to legal, technical, platform, public-record, or jurisdictional limitations.

Dashboards should protect sensitive personal information through role-based access control, multi-factor authentication, encryption, audit logging, data minimization, and least-privilege access. Organizational reporting should be aggregated or anonymized where feasible, with individual-level details limited to authorized users with a defined need to know. The Department may define specific reporting, dashboard, performance, and service-level requirements in a future solicitation based on final scope, data sensitivity, implementation model, and operational risk.

34 Infoblox Service model

Do you need a formal case-management workflow and documented evidence trail for each incident?

Respondents should describe formal case-management capabilities, including case creation, severity classification, assignment, status tracking, evidence capture, action history, closure reason, recurrence tracking, and reporting.

35 Infoblox Coverage expectations

Do you expect the solution to handle data broker opt-out management directly?

Refer to the Department’s response to Question #8.

36 Infoblox Coverage

Do you expect the solution to suppress or remove results from people-search websites even when the content is public but not fraudulent?

Refer to the Department’s response to Question #26.

37 Infoblox Coverage

Do you expect removal support for cached pages, archived pages, business listings, or search-index pages?

Respondents should describe available removal, suppression, de-indexing, monitoring, and escalation support for cached pages, archived pages, business listings, search-index pages, and similar sources. Respondents should clearly identify limitations where removal depends on third-party cooperation, law, jurisdiction, or platform policy.

38 Infoblox Coverage expectations

Do you need support for threats appearing in closed messaging platforms such as WhatsApp, Telegram, Discord, or Signal?

Respondents should describe whether they can detect, monitor, or support escalation for threats appearing in closed or semi-closed platforms such as WhatsApp, Telegram, Discord, Signal, or similar channels. The Department recognizes that access, monitoring, and remediation may be limited by privacy, consent, legal, technical, and platform constraints.

39 Infoblox Coverage expectations

Do you require the solution to address inactive similar domains, or only those being used for active fraud or impersonation?

Respondents should describe their ability to identify, monitor, and risk-rank similar domains, lookalike domains, inactive domains, and domains used for fraud, impersonation, or targeting. Priority should be placed on domains that present active or credible risk, while inactive domains may be monitored or reported based on threat context.

40 Infoblox Security and compliance

Do you require all services and personnel handling the program to be U.S.-based?

Refer to the Department’s response to Question #11.

41 Infoblox Security and compliance

What compliance frameworks or attestations are required or preferred, such as SOC 2, ISO 27001, NIST CSF, FedRAMP, or CJIS?

Refer to the Department’s response to Question #9.

42 Infoblox Security and compliance

Are there any restrictions on collecting or storing selfies, identity documents, phone numbers, or other sensitive data for protected individuals?

Refer to the Department’s response to Question #6.

43 Infoblox Security and compliance

Do you require MFA, encryption at rest and in transit, audit logs, backup, disaster recovery, and business continuity details in the response?

Refer to the Department’s response to Question #9.

44 Infoblox Security and compliance

Would you accept a secure self-service enrollment process for protected personnel to submit their monitoring data directly?

Refer to the Department’s response to Question #6.

45 Infoblox Implementation and pricing

What rollout timeline are you targeting for onboarding, initial protection, and full deployment?

The Department has not finalized a rollout timeline.

Respondents should provide estimated timelines for onboarding, initial exposure analysis, first reporting, recurring monitoring, removal workflows, support readiness, and full deployment under different enrollment scenarios.

46 Infoblox Implementation and pricing

What internal administrative effort can the Department support for enrollment, approvals, and ongoing case handling?

Refer to the Department’s response to Question #13.

In addition, respondents should describe the level of Department administrative involvement anticipated for enrollment, approvals, reporting, governance, and ongoing case management.

47 Infoblox Implementation

Which pricing model is most useful for planning purposes: per-user, subscription, tiered service levels, enterprise pricing, or another structure?

Refer to the Department’s response to Question #23.

48 Infoblox Implementation

Should optional services beyond core monitoring and removal be priced separately or rolled into the core service?

Respondents should identify what is included in the core service and what is priced separately as optional or enhanced services. Optional services may include enhanced monitoring, concierge support, family or household coverage, urgent escalation, international source coverage, and personal cybersecurity hardening.

49 Infoblox Implementation and pricing

Are there minimum or expected enrollment volumes we should use when framing implementation and pricing assumptions?

Refer to the Department’s response to Question #1.

50 Infoblox Questions to remove ambiguity in our response

If a solution provides strong monitoring, validation, takedown, and recurring protection for malicious or impersonating content, but only limited support for non-fraudulent public-record or data-broker removals, would that still be considered responsive?

The Department is seeking information on integrated capabilities that address both malicious or impersonating content and broader personal information exposure. A solution with limited support for non-fraudulent public-record or data-broker removals should clearly describe those limitations, compensating controls, and whether such capabilities are core, optional, or unavailable.

51 Infoblox Questions to remove ambiguity in our response

If a solution includes immediate protective blocking of malicious destinations while removals are underway, would that be considered a meaningful differentiator for this

RFI?

Protective blocking of malicious destinations may be considered a meaningful value-added capability where it reduces risk while removal or takedown actions are pending.

Such functionality should complement, not replace, monitoring, removal, suppression, escalation, reporting, and case management.

52 Infoblox Questions to remove ambiguity in our response

Are there any must-have use cases, user populations, or content types that should be treated as mandatory in our response versus optional or future-state capabilities?

53 Global Solutions Group

Existing Users / Coverage Scope

What is the estimated number of Department personnel to be covered under the service (initial and future scale)?

54 Global

Group

Existing Users / Coverage Scope

What categories of users will be included (e.g., child protective investigators, law enforcement personnel, attorneys, judges, other high-risk roles)?

Refer to the Department’s response to Question #28.

55 Global

Group

Existing Users / Coverage Scope

Will family members of personnel also be included in scope, as referenced in privacy risk context?

For purposes of this RFI, respondents should describe their ability to support multiple coverage models, including:

• Employee-only coverage

• Employee plus household coverage

• Employee plus immediate family coverage

• High-Value Target/Executive/Family coverage

Respondents should clearly describe how family or household coverage would be defined, enrolled, consented to, verified, priced, administered, monitored, and reported. Respondents should also identify privacy, consent, minor-child, identity verification, data minimization, and operational considerations associated with collecting or processing family or household member information.

The Department is interested in flexible, risk-based service models that can support different coverage levels without creating unnecessary administrative burden or excessive collection of sensitive personal information. Any final decision regarding family or household coverage may be established in a future solicitation based on operational need, privacy risk, safety considerations, funding, implementation feasibility, and applicable legal and compliance requirements

56 Global Solutions Group

Existing Users / Coverage Scope

Are there different service tiers expected based on risk profile or role type?

Refer to the Department’s response to Question #14.

57 Global

Group

Existing Technologies / Environment

Are there any existing tools or services currently used for digital privacy protection or online information removal?

Refer to the Department’s response to Question #22.

58 Global

Group

Existing Technologies / Environment

Is there any existing case management, alerting, or reporting system that needs to be integrated with?

Refer to the Department’s response to Question #20.

59 Global

Group

Existing Technologies / Environment

Does the Department currently use any identity protection or impersonation monitoring solutions?

Refer to the Department’s response to Question #22.

60 Global

Group

Existing Technologies / Environment

Are there any specific data sources, repositories, or systems where personnel data is currently maintained that the solution must integrate with?

Refer to the Department’s response to Question #20.

61 Global

Group

Tools / Technologies Required

• Which of the following capabilities are mandatory vs optional:

o Online personal information removal o Data broker opt-out management o People-search website suppression o Social media exposure mitigation o Impersonation monitoring o Search engine result reduction o Digital privacy monitoring

62 Global

Group

Tools / Technologies Required

What level of effectiveness is expected for suppression/removal from third-party platforms and user-controlled accounts (noted as potential limitation)?

The Department understands that removal or suppression from third-party platforms and user-controlled accounts may be limited. Respondents should describe realistic effectiveness, success rates where available, limitations, recurrence handling, escalation paths, and residual-risk reporting.

63 Global

Group

Tools / Technologies Required

Are dashboards and reporting tools expected to be real-time or periodic?

Respondents should describe whether dashboards and reporting tools are real-time, near-real-time, periodic, or configurable. The Department is interested in reporting that supports operational case management, executive oversight, urgent alerting, and measurable risk reduction.

64 Global Solutions Group

Tools / Technologies Required

Is case management functionality required as part of the solution?

Refer to the Department’s response to Question #34.

65 Global

Group

Monitoring vs Incident Handling

Is the expectation limited to continuous monitoring of exposure or also active remediation/removal actions?

The Department is interested in active remediation and removal support, not monitoring-only notification.

Respondents should describe how findings are validated, prioritized, removed, suppressed, escalated, tracked, and reported.

66 Global Solutions Group

Monitoring vs Incident Handling

Should the vendor handle escalation and response for urgent safety concerns, or only notify the Department?

Refer to the Department’s response to Question #31.

67 Global

Group

Monitoring vs Incident Handling

Are incident response procedures expected to be part of the service offering?

Refer to the Department’s response to Question #31.

68 Global Solutions Group

Monitoring vs Incident Handling

What are the expectations around recurring/continuous monitoring and re-checking for republished information?

The Department expects respondents to describe recurring or continuous monitoring and re-checking for republished, re-indexed, or newly exposed information. Respondents should explain cadence options, recurrence handling, escalation criteria, and reporting.

69 Global Solutions Group

Support Model (24x7 / Availability)

What level of customer support availability is expected (business hours vs 24x7)?

The Department has not finalized a required support schedule. Respondents should describe business-hours, extended-hours, and 24x7 support options, including urgent escalation coverage for critical safety-related events.

70 Global Solutions Group

Support Model (24x7 / Availability)

Are there defined SLAs for handling urgent safety concerns and escalations?

The Department has not finalized specific SLAs.

Respondents should provide proposed service levels for acknowledgment, triage, first action, Department notification, escalation, status updates, and verified mitigation or removal.

71 Global Solutions Group

Support Model (24x7 / Availability)

Should support services be provided exclusively within the United States?

Refer to the Department’s response to Question #11.

72 Global

Group

Tool Licensing vs Services Scope

Is the expectation for a fully managed service model or a tool-based solution with licensing?

Refer to the Department’s response to Question #30.

73 Global

Group

Tool Licensing vs Services Scope

Should pricing be structured as per-user, subscription-based, enterprise model, or tiered service levels?

Refer to the Department’s response to Question #23.

74 Global

Group

Tool Licensing vs Services Scope

Should ongoing monitoring and recurring removal services be included within base pricing or treated as optional?

Refer to the Department’s response to Question #48.

75 Global

Group

Post- Implementation Support / Maintenance

What are the expectations for onboarding timelines and implementation support?

Refer to the Department’s response to Question #45.

76 Global

Group

Post- Implementation Support / Maintenance

What level of ongoing maintenance is required for monitoring and removal activities?

Respondents should describe ongoing maintenance required for monitoring, removal, suppression, recurrence checks, reporting, case management, escalation, user support, and service reviews.

77 Global Solutions Group

Post- Implementation Support / Maintenance

How frequently should data sources be re-checked for reappearance of personal information?

Refer to the Department’s response to Question #68.

78 Global

Group

Post- Implementation Support / Maintenance

What administrative or staffing support is expected from the Department during ongoing operations?

The Department prefers models that minimize administrative burden while maintaining oversight. Respondents should describe expected Department involvement for enrollment, approvals, communications, escalations, reporting, access management, and ongoing governance.

79 Global Solutions Group

Security and Compliance

Which specific security frameworks or certifications are mandatory (e.g., SOC 2, ISO 27001, NIST CSF, FedRAMP, CJIS)?

At a minimum, the Department must comply with applicable NIST SP 800-53 Rev. 5, NIST Cybersecurity Framework, CJIS Security Policy, ARC-AMPE, IRS Publication 1075, and F.A.C. 60GG-2, as applicable.

Respondents should describe any relevant certifications, attestations, and alignment with these or comparable standards.

80 Global

Group

Security and Compliance

Are there any specific encryption, access control, or MFA requirements to be followed?

Respondents should describe encryption in transit and at rest, MFA, role-based access control, least privilege, privileged access controls, audit logging, access reviews, and secure data handling practices.

81 Global Solutions Group

Security and Compliance

What are the expectations around audit logging, monitoring, and incident response capabilities?

For planning purposes, respondents should describe audit logging, monitoring, incident response, alerting, administrative activity tracking, user activity logging, security event handling, retention, export capabilities, and support for security oversight.

82 Global Solutions Group

Security and Compliance

Are disaster recovery and business continuity capabilities mandatory requirements?

For planning purposes, respondents should describe backup, redundancy, disaster recovery, business continuity, recovery objectives, testing frequency, and how service continuity is maintained during outages or incidents.

Specific disaster recovery and business continuity requirements may be established in any future solicitation.

83 Global Solutions Group

Implementation and Scalability

What are the expected onboarding timelines and key milestones?

Refer to the Department’s response to Question #45.

84 Global

Group

Implementation and Scalability

How should the solution scale for varying numbers of enrolled personnel?

Respondents should describe how the solution scales across different enrollment levels, risk tiers, covered populations, reporting needs, support models, and administrative requirements while maintaining security, privacy, performance, and service quality.

85 Global Solutions Group

Implementation and Scalability

Are there any constraints or dependencies that could impact implementation?

Respondents should identify constraints or dependencies that could impact implementation, including data availability, enrollment method, user consent, identity verification, integration needs, staffing, support model, third-party platform limitations, legal constraints, or public-record limitations.

86 Global Solutions Group

Reporting and Effectiveness

What metrics will be used to measure service effectiveness?

Refer to the Department’s response to Question #13.

87 Global

Group

Reporting and Effectiveness

What reporting frequency and format is expected (dashboard, periodic reports, alerts)?

Refer to the Department’s response to Question #33.

88 Technuf For planning purposes, how many personnel should vendors assume for the initial implementation, and what is the estimated maximum number of personnel the solution should support as it scales?

89 Technuf Does the security coverage apply only to DCF-identified personnel, or does it also extend to household members or immediate family members whose exposed information could create a safety or privacy risk?

Refer to the Department’s response to Question #17.

90 Technuf In our experience, mandatory enrollment typically…