Addendum No. 1 - Q&A.pdf

Digital Security Solutions

Request for Proposals (RFP)

No. 24-43230000-RFP

Questions and Answers and

Addendum No. 1

Questions and Answers

The Department has received the following questions through the Business Network. The questions are shown below exactly as they were received. The Department’s answers are provided in the table listed below:

No. Question Answer

1 The pricing attachment instructions references interactive drop down menus for selection of applicable “service category” as well as selecting the “unit of measure”.

However upon opening the attachment it does not appear the document is interactive and does not have working drop down menus as described in the instructions. Once the solicitation moves to "open" stage will the pricing attachment have a workable drop down menu as per the pricing instructions? If not, please advise.

Please see Attachment B, Revised Price Proposal.

2 If responding to multiple different service categories with separate solutions, is it acceptable to submit separate technical response documents and separate pricing documents for each individual service category solution we are proposing?

Yes, each Solution proposed for a Service Category should have a separate Price and Technical Proposal.

3 Attachment C - Technical Proposal Instructions and Evaluation Criteria indicates vendors’ technical submissions should each be named “Respondent Name_Technical_Proposal”; however, bidders with technical proposals for multiple service categories will experience multiple files with the same name in the same upload field in the Ariba platform. Please consider revising the naming convention to include the service category number as well.

Please see Attachment C, Revised Technical Proposal.

4 The solicitation states the State will not accept unrequested terms and conditions.

Some solutions may require the inclusion of third-party products subject to the applicable third-party end user terms and conditions.

Please advise how Respondents are to address the inclusion of third-party terms and conditions, such as EULAs.

This will be addressed on a Customer purchase level pursuant to section 4.1 of the Statement of Work.

5 Does the State anticipate proposals from manufacturers and value-added resellers?

Yes.

6 If an OEM chooses to respond directly, can the OEM specify resellers (VARs)? If so, is there a limit to how many can be specified, and are there any specific requirements for

The RFP and it’s attached contract do not authorize a Respondent to specify resellers.

the resellers (VARs)? If so, how do resellers (VARs) add additional items, including value added items, if the OEM is responding with multiple resellers (VARs)?

7 Are distribution partners authorized to respond directly?

Yes.

8 Can an awarded contractor specify additional resellers for the proposed solutions?

No.

9 Are resellers (VARs) authorized to respond with multiple OEM(s) per solution? If yes, do resellers submit multiple responses?

“Solution” is defined in section

1.2 of the RFP as “[t]he products, services, or software proposed to meet the needs of a Service Category.” The RFP does not specify a limit on the number of Solutions a Respondent can propose per Service Category.

Pursuant to Attachments B and C, a Respondent is required to submit a separate Price and Technical Proposal per Solution.

10 If multiple VARs respond with the same OEM, will multiple VARs be awarded per solution?

Multiple VARs with the same OEM may be awarded. Please see RFP Section 2.9 Basis of Award.

11 Regarding Attachment A – Scope of Work –

3.6.2 Multi-Source Mail Traffic Analysis, is

Google Workspace environment in scope?

Please see Attachment A, Scope of Work, Section 3.6, Email Security.

12 Regarding Attachment A – Scope of Work –

3.1.1 Integration, please provide specifics

about which Firewall, EDM, and SIEM solutions are used and need to be integrated.

This RFP will result in a state term contract. Current infrastructure will vary Customer to Customer. Respondents should provide all available Solution components to address the Scope of Work.

13 Attachment A – Scope of Work – 3.1.11 Data Export states: “Shall provide the ability to generate a customizable export of data based on user filters for assets, services, and issues present within the platform.” Please expand on the meaning of this requirement.

Please see Attachment A – Revised Scope of Work, section 3.1.11, Data Export.

14 If an OEM chooses to respond directly, can the OEM specify resellers (VARs)?

No.

15 If so, is there a limit to how many can be specified, and are there any specific requirements for the resellers (VAR)s?

N/A

16 If so, how do resellers (VARs) add in additional items, including value-added items, N/A if the OEM is responding with multiple resellers (VARs)?

17 Are distribution partners authorized to respond directly?

Yes.

18 Can an awarded contractor specify additional resellers for the proposed solutions?

No.

19 Are resellers (VARs) authorized to respond with multiple OEM(s) per solution?

If yes, do resellers submit multiple responses?

“Solution” is defined in section

1.2 of the RFP as “[t]he products, services, or software proposed to meet the needs of a Service Category.” The RFP does not specify a limit on the number of Solutions a Respondent can propose per Service Category.

Pursuant to Attachments B and C, a Respondent is required to submit a separate Price and Technical Proposal per Solution.

20 If multiple VARs respond with the same OEM, will multiple VARs be awarded per solution?

Multiple VARs with the same OEM may be awarded. Please see RFP Section 2.9, Basis of Award.

21 If an OEM chooses to respond directly, can the OEM specify resellers (VARs)?

No.

22 If so, is there a limit to how many resellers can be specified, and are there any specific requirements for the resellers (VARs)?

N/A

23 If so, how do resellers (VARs) add in additional items, including value-added items, if the OEM is responding with multiple resellers (VARs)?

N/A

24 Are resellers (VARs) authorized to respond with multiple solutions/OEMs per Service Category?

Yes. A separate Proposal must be submitted per Solution.

25 If resellers are responding with multiple solutions/OEMs per Service Category, are individual Technical Proposals required (ex.

VAR can propose 4 solutions/OEMs for Category 3. Is the expectation that they provide 4 Technical Proposals for Category 3 or can the 4 solutions be summarized in one

In the example, 4 Technical Proposals would be required, as a separate Technical Proposal must be submitted per Solution.

Please see Attachment C, Revised Technical Proposal, “The Respondent shall prepare

Technical Proposal as long as all evaluation factors are addressed)?

and submit a Technical Proposal for each proposed Solution according to the criteria and instructions provided in this attachment.”

26 If multiple VARs respond with the same OEM, will multiple VARs be awarded per solution?

Multiple VARs with the same OEM may be awarded. Please see RFP Section 2.9 Basis of Award.

27 Are distribution partners authorized to respond directly?

Yes.

28 If a distribution partner is an awarded contractor, can that distribution partner specify additional resellers for the proposed solutions?

No.

29 Can you please provide information regarding your current infrastructure? (Ex. Is it hosted on-prem or in the cloud? If cloud, then which provider(s)? Which services are you currently using?)

This RFP will result in a state term contract. Current infrastructure will vary Customer to Customer.

30 Can you list the existing tools used for each category, if any?

This RFP will result in a state term contract contract. Existing tools will vary based on the Customer.

31 Please clarify whether vendors are only allowed to respond to one service category per proposal? And whether we are allowed to respond to multiple service categories (by submitting multiple proposals)?

Respondents are able to respond to multiple service categories by submitting multiple proposals.

32 Can vendors provide pricing in a different format then what is requested? Can we propose a different pricing structure such as Discount off MSRP or cost+ pricing?

No.

33 The State has requested and received consistent feedback from multiple vendors that the lack of any Limitation of Liability would limit competition. As such, would the State be willing to include (for all vendors) a mutually agreeable Limitation of Liability and a consequential, indirect, incidental, special, and punitive damages disclaimer for Vendor?

Please see Revised Attachment E, Special Contract Conditions.

34 Would the State be willing to include the Limitation of Liability provision from PUR 1000 in the finalized State Term Contract?

Please see Revised Attachment E, Special Contract Conditions.

35 Attachment E Section 2.3.1 (Suspension of Work): Would the State be willing to modify this section (for all vendors) as to clarify that

No. Please see the RFP, Section

3.2 #4, Terms and Conditions.

any suspension or partial termination would be subject to a mutually agreed change control process to address any impacts?

36 Attachment E Section 2.3.2 (Termination for Convenience): Would the State be willing to modify this section (for all vendors) to delete the word “satisfaction” in order to make this provision “objective” and based upon completion of services pursuant to the terms of the Contract?

No. Please see the RFP, Section

3.2 #4, Terms and Conditions.

37 Attachment E Section 2.3.3 (Termination for Cause): Would the State be willing to modify this section (for all vendors) as to clarify that all vendors would be entitled to a reasonable cure period (if the event is curable) in the event of a material breach?

No. Please see the RFP, Section

3.2 #4, Terms and Conditions.

38 Attachment Section 3.2.2 (Preferred Pricing):

Would the State mark this provision inapplicable similar to how they did in the Management Consulting Services RFP, in which they included this language in the Additional Special Contract Conditions: “This section of the Special Contract Conditions is not applicable to the Contract?”

Please see Revised Attachment E, Special Contract Conditions.

39 Attachment E Section 6.7 (Time is of the Essence): Would the State be willing to delete this provision or mark it as not applicable as the work hereunder will be based upon mutual cooperation of the State and the vendor and thus, the vendor could miss a deadline through no fault of their own and automatically be in default if this provision is left as is?

Please see Revised Attachment E, Special Contract Conditions.

40 Attachment E Section 7.4 (Performance Bond): Would the State confirm that no performance bond is required?

Per Attachment E, section 7.4 Performance Bond, the Department may require a performance bond.

41 Attachment E Section 7.5 (Indemnification):

Would the State be willing to delete the current indemnification provision and replace it with the indemnification provision from PUR 1000?

Please see Revised Attachment E, Special Contract Conditions.

42 Attachment E Section 7.5 (Indemnification):

The State has requested and received consistent feedback from multiple vendors that an overly broad indemnification would limit competition. As such, would the State be willing to modify the indemnification provision (for all vendors) so as to clarify that the indemnity herein apply to third party claims for bodily injury, death, and damage to real or tangible personal property to the extent directly and proximately caused by our negligence or intentional misconduct while engaged in the performance of the Services;

and for infringement by our work product subject to certain standard exceptions?

Please see Revised Attachment E, Special Contract Conditions.

43 Attachment E Section 8.4 (Intellectual Property): Would the State be willing to modify the language herein (for all vendors) to clarify that each vendor will maintain ownership of its pre-existing IP?

No. Please see the RFP, Section

3.2 #4, Terms and Conditions.

44 Attachment E Section 9 (Data Security): In the 2nd sentence of Section 9, would the State be willing to delete “The Contractor and subcontractors will not perform any of the services from outside of the United States, and” so that the 2nd sentence reads “The Contractor will not allow any State of Florida data to be sent by any medium, transmitted, or accessed outside the United States due to Contractor’s action or inaction.” This edit would maintain the security of the State’s data and prohibit any data to be accessed outside of the US, but would allow more competitive pricing by the use of offshore resources (but without access to Florida data). Statement of Work, Section 3.1.4 seems to support this revision as well.

45 Statement of Work, Section 10 (Financial Consequences): Would the State be willing to modify this section (for all vendors) to clarify that vendors will not be liable for financial consequences due to events outside of their control?

46 Statement of Work, Section 10 (Financial Consequences): Would the State be willing to modify this section (for all vendors) to include an overall cap on financial consequences?

No. Please see the RFP, Section

3.2 #4, Terms and Conditions.

47 RFP Section 1.4 (Service Categories): In most Service Categories, the State has requested Vendors to provide ‘product or services.’ Please confirm that the Vendor can bid for add-on services without bidding for a specific product for one or more Service Category.

Respondents cannot only provide add on services.

48 Attachment A Section 3.1.1 and 3.1.2 (Scope of Work): The requirement states that the solution should integrate with Customer's existing security tools. Can the State share the existing security tools (for firewalls, end-point management, SIEM, IAM)?

This RFP will result in a state term contract. Existing security tools will vary from Customer to Customer.

49 Attachment A Section 1 (Purpose): What is the minimum volume of Customers expected to use the Vendor’s solution and services?

The State does not have a minimum figure. This RFP will result in a state term contract and usage will be determined by the Customer’s needs.

50 Attachment E Section 9 (Data Security): Are US-based resources required or can vendors use offshore resources to help reduce costs and accelerate delivery timelines?

Yes, US-based resources are required. Please see Attachment E, Special Contract Conditions Section 9, Data Security.

51 How many agencies in each pricing tier will be included in this RFP award?

Customers include State Agencies and Eligible Users as defined by Rule 60A-1.001, Florida Administrative Code.

Customers are not divided by pricing tier.

52 How many total workstations and servers will be covered by this contract?

This RFP will result in a state term contract. Total workstations and servers will vary from Customer to Customer.

53 Will additional products not on last year's contract award be considered?

This question is unclear.

54 Will multiple VARs be selected to provide the same vendor's solutions?

Please see the RFP Section 2.9 Basis of Award.

55 Will tools that cross categories be considered and how will they line up into the categories?

Solutions that span multiple Service Categories are eligible for consideration, provided they satisfy the requirements of each relevant Service Category.

Respondents shall submit a price and technical proposal for each Service Category that the proposed cross category Solution applies to in accordance with the

RFP.

56 If so, will 2 vendors be allowed awards in the same category to make a complete offering?

This question is unclear.

57 Will additional products be able to be added mid-term?

Additions or changes to Solutions, Value-Added Services or Optional Services are not contemplated during the term of the contract.

58 We are seeking clarification on the requirements to bid on Section 7: Security Operations Center. Does FLDS intend to allow Endpoint/XDR Platform vendors in this category or is it restricted to MSSP's like Reliaquest and Secureworks?

We are under the assumption it was intended for MSSPs that can monitor and alert, using human analysts, on ANY prescribed datasource ie firewalls or other nonendpoint related datasources. While it is true that platform vendors like ourselves and our closest competitors can "alert" on these other data sources, it is important to distinguish the difference between a firewall alert that goes direct to the customer (in the case of a platform vendor) and an alert that is escalated from an live analyst at an MSSP. Another important fact is that an MSSP can start an investigation from any datasource alert where a platform vendor will only start an investigation with an endpoint or identity alert.

For these reasons we request clarification on the intent of this category and which type of companies should submit requests to ensure a proper response and reduce customer confusion.

Please see Exhibit A, Scope of Work, Section 3.8, Service Category 7: Security Operations Platform.

59 From document/Attachment A "Scope of Work":

Please verify if it is the intent of the State to receive responses only from OEM's/manufacturers.

Responses are not limited to only OEMs/manufacturers.

60 From Attachment B "Price Proposal" No.

Would the State be open to receiving responses that show a mandatory minimum discount off of internet list for the items provided?

61 From Attachment E "Special Contract Conditions"

Is the State open to accepting redlines or negotiating terms with awardees?

No. Please see the RFP, Section

3.2 #4, Terms and Conditions.

62 Does the State expect the vendor to specify the actual tool used to support each in-scope domain?

Yes.

63 Should the pricing be all-inclusive, covering both implementation and support of the technology, or should each component— technology, implementation, and management—be itemized separately?

Solutions should meet all required specifications of their respective Service Category.

Please refer to Exhibit B, Price Proposal. Anything that is not contemplated by the Service Category and is charged separately should be included as an Add-On Service.

64 Is the vendor allowed to propose multiple solutions for the same domain?

Yes.

65 How many agencies in each pricing tier will be included in this RFP award?

Customers include State Agencies and Eligible Users as defined by Rule 60A-1.001, Florida Administrative Code.

Customers are not divided by pricing tier.

66 How many total workstations and servers will be covered by this contract?

This RFP will result in a state term contract. Total workstations and servers will vary from Customer to Customer.

67 Will additional products not on last year's contract award be considered?

This question is unclear.

68 Will tools that cross categories be considered and how will they line up into the categories?

Solutions that span multiple categories are eligible for consideration, provided they satisfy the requirements of each relevant category.

Respondents shall submit a response for each service category that the proposed cross category Solution applies to.

69 If so, will 2 vendors be allowed awards in the same category to make a complete offering?

This question is unclear.

70 Will additional products be able to be added mid-term?

No.

71 We are seeking clarification on the requirements to bid on Section 7: Security Operations Center.

Does FLDS intend to allow Endpoint/XDR Platform vendors in this category or is it restricted to MSSP's like Reliaquest and Secureworks? We are under the assumption it was intended for MSSPs that can monitor and alert, using human analysts, on ANY prescribed datasource ie firewalls or other non-endpoint related datasources. While it is true that platform vendors like ourselves and our closest competitors can "alert" on these other data sources, it is important to distinguish the difference between a firewall alert that goes direct to the customer (in the case of a platform vendor) and an alert that is escalated from an live analyst at an MSSP.

Another important fact is that an MSSP can start an investigation from any datasource alert where a platform vendor will only start an investigation with an endpoint or identity alert. For these reasons we request clarification on the intent of this category and which type of companies should submit requests to ensure a proper response and reduce customer confusion.

Please see Exhibit A, Scope of Work, Section 3.8, Service Category 7: Security Operations Platform.

72 Is it the State’s intent to procure the Year 2 “round 1” grant awards using the new State Term Contract-RFP No.: 24-43230000-RFP?

This RFP will result in a state term contract.

73 Can manufacturers respond to the RFP with multiple resellers under the same solutions category?

Respondents should respond with all applicable Solutions per Service Category.

74 What is the contract term? Attachment F has “Insert a Date” in both places.

The Contract term is 2 years from date of execution. See Attachment F, Draft Contract, Section I.

75 Do the responses for 3.1 Digital Security Solutions Requirements for each category count towards the 20-page limit?

A separate Proposal must be submitted for each proposed Solution.

76 3.1.13 Change Management Integration - Can you provide an example of a “change management process and tool”? (Our solution is 100% cloud based and updated at mostly scheduled intervals, with no downtime required.)

This RFP will result in a state term contract. Existing change management processes or tools will vary based on the Customer.

77 3.5.4 Service Identification - Can you clarify or provide an example of “cross-correlate the queried data with various security tools.”?

Please see Attachment A, Revised Scope of Work, Section 3.5.4., Service Identification.

78 Regarding SOW Section 4, Will the State be issuing RFQs for any customer procuring any capabilities off the new STC or just for Service Categories 6 and 7? "Customers shall issue a Request for Quote (RFQ) to all Contractors in the applicable Service Category. Prior to issuing an RFQ for Service Categories 6: Content Delivery Network and 7: Security Operations Platform, agencies within the Enterprise shall consult with FL[DS] at purchasing@digital.fl.gov to determine if the RFQ complies with the Enterprise Architecture, as those terms are defined in section 282.0041, F.S. Agencies within the Enterprise shall comply with Rule 60GG- 5.002, F.A.C."

Customers can issue RFQs for any of the 7 Service Categories.

Service Categories 6 and 7 require prior consultation with FL[DS] before an RFQ can be issued.

79 3.9 Optional Add-On Services and 3.10 Value-Added Services - Do sections 3.9 and

3.10 count toward the 20-page limit.

Optional Add-On Services are not scored and should be included and described as instructed in Exhibit B, Price Proposal. Value-Added Services are scored in accordance with Exhibit C, Technical Proposal and their descriptions do count toward the page limit.

80 We are submitting more than 1 Technical Proposal for our Services. In Attachment C, the instructions say “The electronic file should be labeled Respondent Name_Technical_Proposal.” How should we differentiate between our proposals in the file name?

Please see Change 2 of Addendum No. 1 below.

81 3.1.1 Shall integrate with the Customer’s existing security tools such as firewalls, endpoint management solutions, and security information and event management (SIEM) systems. Each Customer shall determine if the Solution is able to integrate with their security tools. The Contractor shall take any steps necessary to support Customer integration. The Solution shall be capable of data integration through common exchange techniques and frameworks.

Can you tell us what the Customer’s existing security tools such as Firewalls, endpoint management system, and SIEM are that we will need to integrate with? Or can you provide examples of some of the Firewalls, endpoint management system, and SIEM are that we will need to integrate with?

This RFP will result in a state term contract. Existing security tools will vary based on the customer.

82 3.1.2 All solutions must seamlessly integrate with existing Identity Access Management (IAM) systems to manage endpoint access in alignment with established user identities and permissions, ensuring that endpoint security configurations reflect organizational access policies.

Can you provide examples of some of the IAM systems that are in use that we will need to integrate with?

This RFP will result in a state term contract. Existing IAM systems will vary based on the Customer.

83 3.1.4 the Solution Architecture must be designed to ensure high scalability and resilience, supporting the organization’s growing needs while maintaining high availability and performance. The Solution Shall provide as Software as a Service via cloud-hosted infrastructure to keep current with the latest releases of management server and endpoint agent software. The Solution shall allow capacity extensibility in the cloud with minimal impact on agent or management infrastructure.

What SD-WAN platform(s) is(are) currently being used? Or can you provide examples of some of the SD-WAN platforms that are currently being used?

This RFP will result in a state term contract. Existing SD-WAN platforms will vary based on the Customer.

84 3.1.13 Solution must be able to integrate with change management processes and tools, This RFP will result in a state term contract. Current Change facilitating coordination between the Vendor and the organization.

What is your current Change Management Platform? Or what change management platforms are in use?

Management Platforms will vary based on the Customer.

85 3.6 The Solution shall analyze incoming email messages and detect potential threats in real-time. The Solution shall be designed to be highly effective at identifying and blocking malicious emails, while minimizing false positives (legitimate emails that are mistakenly blocked).

How many e-mail inboxes are currently being supported?

This RFP will result in a state term contract. Number of inboxes being monitored will very based on the Customer.

86 3.6 The Solution shall analyze incoming email messages and detect potential threats in real-time. The Solution shall be designed to be highly effective at identifying and blocking malicious emails, while minimizing false positives (legitimate emails that are mistakenly blocked).

Of the e-mail boxes being supported:

a) How many are on the Microsoft platform?

B) How many are on the Google platform?

This RFP will result in a state term contract. Email platform will vary based on the Customer.

87 3.6 Secure Email Gateway (SEG) - for both inbound and outbound email provided as a cloud service. This service must process and filter Simple Mail Transfer Protocol (SMTP) traffic and will require organizations to change their Mail Exchange (MX) record to point to the SEG.

What is your current e-mail gateway?

This RFP will result in a state term contract. Current email gateway will vary based on the Customer.

88 3.7.14 Initial integration shall include connecting each Customer to the state Cybersecurity Operations Center (CSOC) and validating with Florida Digital Service (FL[DS]) that all Solution data is properly integrated, as requested by the Customer. Integration maintenance may be required after initial integration to ensure that the Solution properly exchanges data between Customers and the CSOC. The Contractor shall address any concerns that FL[DS] has regarding integration issues.

How many customers need to connect to the State CSOC?

This RFP will result in a state term contract. CSOC connectivity needs will vary.

89 3.7.14 Initial integration shall include connecting each Customer to the state Cybersecurity Operations Center (CSOC) and validating with Florida Digital Service (FL[DS]) that all Solution data is properly integrated, as requested by the Customer. Integration maintenance may be required after initial integration to ensure that the Solution properly exchanges data between Customers and the CSOC. The Contractor shall address any concerns that FL[DS] has regarding integration issues.

Of the customers that need to connect to the State CSOC how many are considered:

a) small;

b) medium;

c) large?

This RFP will result in a state term contract. CSOC connectivity needs will vary.

90 Will the State accept any exceptions or term edits to the PUR 1000 General Conditions, Scope of Work, or Special Contract Terms, or would this result in Respondent's disqualification?

Please see Attachment B, Revised Special Contract Conditions.

91 Should Respondent's proposed solutions incorporate third party vendors, would the State consider alternative third party terms as additional or supplementary?

Respondents proposed Solution should include all variables needed to complete the Service Categories Scope of Work.

92 Should the State accept edits in what format should these be submitted?

The State is not accepting edits.

Please refer to the RFP, Section

93 Will the State accept proposals for Optional Add-On Services as a standalone offering without Category 1 -7 responses?

No.

94 Please clarify which Contractor personnel will be required to submit Background Checks through the U.S. Department of Homeland Security E-Verify system? Is this limited to personnel with unencrypted access to State data, physical access on site, etc?

Please refer to Attachment D, Additional Special Contract Conditions, Section 13.2, E- Verify.

95 Service category #3 refers to EDR services but section 3.4.2 is asking for XDR capabilities. Would FLDS like response for XDR services submitted under this category?

Respondents should include all applicable information related to a respective Solution’s minimum specifications.

Please refer attachment C, Revised Technical Proposal

96 Section 3.1.1-3.1.13 : If we meet these requirements does FLDS want responses to this section with specific details?

Please see Attachment C, Revised Technical Proposal.

97 Service category #3: While the RFP does not specifically call out the need for FedRAMP compliant services, would FLDS like to see pricing and options meeting those requirements? Like most SaaS FedRAMP compliant services the feature/functionality and cost of our FedRAMP offering varies from our commercial offering.

Please see Attachment B, Revised Price Proposal, Add-On Services (OPTIONAL).

98 Does the Security Operations Platform have to integrate with an existing SOC platform at the State level for governance? Or Is a State SOC solution for multi-tenancy/central management of security data for local/state agencies what is being requested?

This RFP will result in a state term contract.

99 3.3.1 is asking for an agentless discovery solution, but 3.3.2 is asking for the ability for remote management, instillation patching, and configuration management, which would require an agent be installed. Please provide some clarification.

Please see Attachment A, Revised Scope of Work, section 3.3.2, Remote Management and Data Security.

100 3.3 Service Category 2: Network-Based Asset Discovery:

-Can activities in this service category be performed remotely, or will a resource be required onsite?

This will be determined by the Customer on a Purchase Order level.

101 3.3.2 Remote Management and Data Security

“Shall provide the ability to identify all networked devices and enforce policies remotely, without the need for direct physical access. This may include tasks such as software installation, patching, and configuration management.”

- Would it be acceptable for the provider to give guidance and best practices as opposed to performing installations, patching, and config management? E.G. the provider could advise on what should be installed/patched/configuration, but not perform said actions?

Please see Attachment C, Revised Technical Proposal.

Respondents should include all relevant information related to how their proposed Solution meets the minimum requirements.

102 3.5.8 Asset Management and Ownership

“The Solution shall provide the automated ability to flexibly assign network ownership supporting hierarchical network oversight relationships. The Solution shall accurately determine ownership of Customer subnetworks, domains, certificates, services, and Autonomous System Numbers (ASNs) with minimal false positives or false negatives”

-Should the solution be able to provide this functionality natively, or is the expectation that the solution will integrate with another DMS owned system which ingests ownership data and makes assignments?

Please see Attachment C, Revised Technical Proposal.

Respondents should include all relevant information related to how their proposed Solution meets the minimum requirements.

103 What is the total number of users/employees in your organization?

This RFP will result in a state term contract. The number of users/employees will vary based on the Customer.

104 Do you require some/all resources to be onsite or is remote delivery acceptable? If some, please list the roles requested to be onsite?

This will be determined by the Customer on a Purchase Order level.

105 Please provide a resource outline of the current cybersecurity team by role?

This RFP will result in a state term contract. Current resources will vary based on the Customer.

106 Are there any initial onboarding requirements for this engagement? (Staff and/or Technology)

This RFP will result in a state term contract. Initial requirements will vary based on the Customer.

107 Are you requesting full tool mgmt. in addition to addressing the alerts of these tools?

108 Can you provide the OS Versions and patch baseline for each OS supported?

This RFP will result in a state term contract. OS version and patch baseline will vary based on the Customer.

109 Can you provide the number & type of each operating system in scope?

This RFP will result in a state term contract. Number and type of operating system will vary based on the Customer.

110 Can you describe the breakout of the SIEM tools and the log collection methodology (what logs are being collected where)?

This RFP will result in a state term contract. SIEM tools and log collection methodology will vary based on the Customer.

111 What are the related security technologies currently integrated to SIEM for example - UEBA, SOAR, WAF, DAM etc?

This RFP will result in a state term contract. Currently integrated security technologies will vary based on the Customer.

112 Please confirm the EDR solution deployed? This RFP will result in a state term contract. Already deployed EDR solutions will vary based on the Customer.

113 Please provide the current size of existing operations for all environments?

This RFP will result in a state term contract. Environments will vary based on the Customer.

114 Please provide the expected size of existing operations for all environments?

This RFP will result in a state term contract. Expected size of operations will vary based on the Customer.

115 Are there any technologies in consideration for future integration into the SIEM?

This RFP will result in a state term contract. SEIM integration will vary based on the Customer.

116 Are you currently leveraging threat intelligence in your SOC? If yes, please list applicable threat intelligence solutions

This RFP will result in a state term contract. Threat intelligence will vary based on the Customer.

117 Are their any SaaS or third-party services to be considered in scope?

Any additional Add-On Services and associated pricing should be included in the Add-On Services section of the Attachment B, Price Proposal.

118 Please share list of automations configured in

SOC.

This RFP will result in a state term contract. Automations will vary based on the Customer.

119 What are the types of cloud resources that are deployed? (e.g. IaaS, PaaS, etc.)

This RFP will result in a state term contract. Deployed cloud resources will vary based on the Customer.

120 How are security incidents currently identified, notified, escalated and tracked?

This RFP will result in a state term contract. Security incident tracking and response will vary based on the Customer.

121 What is the total number of use cases configured?

This RFP will result in a state term contract. Total number of use cases configured will vary based on the Customer.

122 Please share count of alerts and incidents to be handled on weekly basis with time distribution.

This RFP will result in a state term contract. Weekly alerts will vary based on the Customer.

123 Can you estimate the number of incidents per month by severity level?

This RFP will result in a state term contract. Estimated number of incidents will vary based on the Customer.

124 Please provide the False/True Positive breakup of the incidents per month?

This RFP will result in a state term contract. False/True positive breakdown of incidents per month will vary based on the Customer.

125 What has been the historic growth rate of the incidents and what is the expected growth rate YOY?

This RFP will result in a state term contract. Incident growth rate will vary based on the Customer.

126 Please outline any user behavior analytics solution presently being used in the organization?

This RFP will result in a state term contract. User analytics solutions will vary based on the Customer.

127 Does the State intend to award this RFP to a single reselling partner or multiple reselling partners per Manufacturer's solution? Is the intent of the RFP lending itself to more of an aggregate State Contract than a typical solution focused RFP?

Please see RFP Section 2.9 Basis of Award.

128 RFP Overview, 2.8.2 Technical Proposal Scoring, Page 12

RFQ Text: "Only one Technical Proposal for each Solution for a Service Category from each Respondent will be evaluated for award.

Add-On Services shall not be evaluated but Value-Added Services are evaluated for purposes of the Technical Proposal."

Question: Is the intent of the State to only allow for one Manufacturer's solution per Respondent per Category? If so, that will limit the submitting partner to propose only one Manufacturer's solution per Category, thus precluding the Reselling partner to provide various Manufacturer's solutions when working with a participating Agency or Entity, and limit that Reselling partner to only offering one Solution per Category.

Multiple VARs with the same OEM may be awarded. Please see RFP Section 2.9 Basis of Award.

129 Attachment C, Page 1 If a Respondent is allowed to submit for more than one Manufacturer's solution within one Service Category, will the 20 page limit apply to all Manufacturer's solutions within the proposal? Or will the State allow 20 pages per Manufactuer's solution within one Respondent's submission? If additional pages are allowed for more than one Manufacturer's solution, please clarify the page limit for additional solutions within the same category.

For example, if a Respondent desired to submit 3 Manufacturer's solutions for Endpoint Detection and Response, would the page limit be 20 pages for 3 separate Manufacturer's solutions for Endpoint Detection & Response, or 60 pages (20 pages per Manufacturer's solution)?

Yes, each solution proposed for a service category should have a separate Proposal.

130 Attachment C, Page 1, Experience

Will the State please clarify the details for scoring a Respondent's Experience? For example: the number of points for the following items: Respondent's Manufacturer's certifications and/or level of Partnership with a Manufacturer; years of Partnership; number of certified engineers; volume of business nationally, locally, etc.? Is the State looking for referenceable customers, if so, please provide the number of references and details requested.

Points for Experience shall be allocated as described in Attachment C, Revised Technical Proposal.

131 Attachment B, Page 1 RFP Text: "Respondent shall, at a minimum:

(1) select the applicable Service Category, (2) enter the name of the Solution proposed, (3) select a unit of measure that is utilized for determining the price from the dropdown menu (which shall be the same for the Initial Term Pricing table and the Renewal Term Pricing table), and (4) enter an applicable price per unit. " Question: Will there be a drop-down menu available within the Ariba Business Network to submit pricing for each Service Category, or will an Excel file be provided as the response template that has the drop-down menu?

No, pricing information should be returned using Attachment B – Revised Price Proposal.

132 Will each agency own their own tenant/license, or would this be a "multi-tenant" approach?

This RFP will result in a state term contract. Approach to licensing will vary based on the Customer.

134 Attachment A, Section 3.1.2 Will the State confirm the Identity Access Management (IAM) solution?

This RFP will result in a state term contract. Implemented IAM solutions will vary based on the Customer.

135 Attachment A, Section 3.1.3 Will the State please clarify the authentication methods?

This RFP will result in a state term contract. Authentication methods will vary based on the Customer.

136 Attachment B For the Price proposal, we are not able to calculate with the metrics used. Will the State please present an option for data ingest per day using Gigabits per day?

Please refer to Addendum No. 1, Section 1, Scoring Methodology.

Bandwidth Usage Speaks to GB as a model.

137 Attachment A, Section 3.8.2 Should this Security operations platform leverage a full-capability Security Orchestration Automation and Response (SOAR) solutions?

Please provide all information relevant to an applicable Solution.

138 Attachment A, Section 3.8.3 Will the State please clarify "customization of caching rules, and SSL settings"?

Please see Attachment A, Revised Scope of Work, section 3.8.3, Incident Reporting.

139 Attachment A, Section 3.8.4 Will the State please confirm if the RFP is looking for a SAAS offering?

The State is looking for Solutions that satisfy the Scope of Work Requirements for a given Service Category.

140 Attachment A, Section 3.8.4 Will the State clarify if the goal is to monitor multi cloud environments, or for the solution to be deployed and run in multiple cloud sources?

This RFP will result in a state term contract. Monitoring specifications will vary based on the Customer.

141 Attachment A, Section 3.8.5 Is the State looking for the Security Operations Platform to provide a threat feed, or integrate with threat intel feeds?

This RFP will result in a state term contract. Customer’s existing infrastructure will vary based on the Customer.

142 Attachment A, Section 3.1.4 Is the State looking for a single license for multiple agencies, or is the State looking for multiple licenses? Will the State please define multi-tenant?

This RFP will result in a state term contract. Customer’s licensing needs will vary based on the Customer.

143 Attachment A, Section 3.1.10 Will the State please clarify the requirements in this Section? Is there a requirement to have a Disaster Recovery site in specific locations?

A disaster recovery site in specific locations is not a requirement. However, please see Attachment E, Revised Special Contract Conditions Section 9, Data Security.

144 Attachment A, Section 3.1.13 Will the State please confirm how it would define "integration" for change management?

Is there a specific platform with which the State would be looking to integrate?

This RFP will result in a state term contract. Platform specifications will vary based on the Customer.

145 RFP, Section 1, Timeline of Events Will the State amend the calendar to extend the due date?

Any changes to the timeline will be noted in an Addendum.

146 How has DMS been procuring these services and solutions?

This RFP will result in a state term contract. How Customers have been previously procuring theses Solutions will vary.

147 Why has DMS decided to procure these services and solutions in a new way with this procurement?

The Department has the authority to procure State Term Contracts pursuant to 287.042 (2)(a), Florida Statutes

148 Does DMS prefer that the original manufacturer of the solutions bid this list or resellers of the solution?

Responses are not limited to only original manufacturers.

149 Is it mandatory for bidders to be the solutions provider or must vendors only be service providers of these solutions?

Responses are not limited to only OEMs/manufacturers.

150 What portion of the 160 Experience points will be for providing the product and what portion will be for the services?

Points for Experience shall be allocated as described in Attachment C, Revised Technical Proposal.

151 Why is there a different point value associated with the respective solutions vs it being the same point value for each solution?

Point value is based on the number of Scope of Work Requirements for a specific Service Category.

152 In section 3.1.1 Integration of the Scope of Work document (Attachment A) it states that All Service Category Contractors shall integrate with the Customer’s existing security tools such as firewalls, endpoint management solutions, and security information and event management (SIEM) systems. Can you please provide details of such security tools (ie Manufacturer, model, version and quantities)?

This RFP will result in a state term contract. Existing security tools will vary based on the Customer.

153 Under section 3.8.7 of the Scope of Work document, we have multiple questions regarding integration: a) Does respondent need to be approved by CSOC prior. b) What kind of integration is required (API, email, etc)? c) Is there a VPN connection required?

This RFP will result in a state term contract. Need for CSOC approval and existing security tools will vary based on the Customer.

154 In section 3.1.13 of the Scope of Work document, reference is made to integrate with the State of Florida DMS change management system. Can you please provide details of the existing Change Management solution used today?

This RFP will result in a state term contract. Change management tools will vary based on the Customer.

155 In reference to the Data Export as provided in section 3.1.11 of the Scope of Work document, are the respondents required to provide the complete raw data in addition to the customized export of data based on user filters for assets, services, and issues present within the platform?

This RFP will result in a state term contract. Data export needs will vary based on the Customer.

156 Are solutions to be managed centrally across all customer environments, or will they be managed on a per-customer basis?

On a Customer basis.

157 Is the tuning or re-vamping any existing security technologies that fall into a given service category in-scope?

Proposed Solution(s) should meet all minimum requirements listed in Attachment A, Scope of Work. Any additional offerings should be included as an Add- On.

158 Will contractors be supplied a list of pre-existing technologies to support integration requirements with new toolsets?

This will be determined by the Customer.

159 During implementation are contractors expected to work with existing 3rd-parties to support the integration of security toolsets?

This will be determined on a Purchase Order level.

160 Will contractors receive support from customer IT stakeholders who have existing knowledge of their environments?

This will be determined on a Purchase Order level.

161 For tooling implementations is a formal training and hand-off period required prior to hand-off to customer IT stakeholders?

This RFP will result in a state term contract. Implementation will vary based on the Customer.

162 Will contractors be supplied with the existing deployment methods available within customer environments?

This will be determined on a Purchase Order level.

163 External- Facing Asset Discovery: How frequently should scanning and monitoring activities be conducted to effectively manage the external attack surface?

Proposed Solution(s) should meet the respective Service Categories minimum specifications.

164 Network-Based Asset Discover: Could you specify the range of network protocols and device types that the solutions must support for agentless discovery (e.g., TCP/IP, Bluetooth, Zigbee)?

Proposed Solution(s) should meet the respective Service Categories minimum specifications.

165 Will the final contract awarded require the inclusion of all the terms and conditions of PUR1001 as amended by the RFP; Exhibit D, Additional Special Contract Conditions; and Exhibit E, Special Contract Conditions?

The PUR 1001 is incorporated into the RFP pursuant to RFP sections 3.1 & 3.2. Please see Attachment F, Draft Contract for a list of all final contract documents.

166 Will the State consider the use of Vendor’s standard contract as a starting point for negotiation?

No. Please refer to the RFP, Section 3.2 #4, Terms and Conditions. Please note this is a

Request for Proposals and not an Invitation to Negotiate.

167 Will the State consider limited exceptions to the terms and conditions of PUR1001 as amended by the RFP; Exhibit D, Additional Special Contract Conditions; and Exhibit E, Special Contract Conditions?

No. Please see the RFP, Section

3.2 #4, Terms and Conditions.

168 Will the State consider additional service specific terms contained in an applicable service schedule?

Customers can negotiate additional terms and conditions on a Purchase Order level.

169 3.1.1 - Can you share the existing tools referenced for us to evaluate ability to support?

This RFP will result in a state term contract. Existing tools will vary based on the Customer.

170 3.1.2 - Can you share the existing tools referenced for us to evaluate ability to support?

This RFP will result in a state term contract. Existing tools will vary based on the Customer.

171 3.1.3 - Can you share the existing tools referenced for us to evaluate ability to support?

This RFP will result in a state term contract. Existing tools will vary based on the Customer.

172 Questions for Appendix B

As the solution may require hardware and/or software to meet the requirements, does the customer seek to procure vendor hardware and software outright so that the customer owns the hardware/software or does the customer desire for the…