Addendum No. 1 & Q&A.pdf

Digital Security Solutions

Request for Proposals (RFP)

No. 24-43230000-RFP-2

Questions and Answers and

Addendum No. 1

Questions and Answers

The Department has received the following questions through the Business Network. The questions are shown below exactly as they were received. The Department’s answers are provided in the table listed below:

No. Question Answer

1 For Attachment M: Experience - Are you requesting only one response with our overall experience or a response for each category with our experience?

Respondents should only provide one Attachment M, Experience, regardless of the number of Solutions proposed and regardless of the number of Service Categories that Solutions are proposed for. The Attachment M, Experience, includes a narrative of the Respondent’s relevant experience for the proposed Service Category(ies).

2 General Question - are Respondents allowed to add Resellers to their contract?

Please refer to section 7.4 of Attachment D, Enterprise Standard Terms and Conditions.

3 The character response limitations... Are these character counts including or excluding spaces?

The character limits in Attachments L1- L16, Technical Attachments, and Attachment M, Experience, includes spaces.

4 For the SASE category 10, would you like responses from SSE (Secure Service Edge) providers that do everything but the local firewall and SDWAN, or would you only like responses if the vendor can provide SDWAN with the other functions like CASB, ZTNA, SWG, etc..?

Respondents should respond with all applicable Solutions per Service Category.

Additionally, please refer to Attachment C, Evaluation Criteria.

5 In Attachments L1-L16, are we able to attach documentation/agreements that would be from the Vendor/Publisher?

Attaching documents is not permitted.

Please refer to Section 2, Service Level Agreement or Additional Terms and Conditions, of Attachments L1-L16, Technical Attachments.

6 For each Service Category, is the desire to have a single 'product' to meet all requirements within that category or can an integrated solution be proposed that utilizes multiple OEM products to meet all requirements within a given service category?

Respondents may submit multiple Solutions per Service Category.

7 Section 3.2.6: What is meant by unauthorized software? Malicious software and/or software that is not approved to be installed.

What a Customer determines as unauthorized software will be determined at the Purchase Order level.

8 Can you explain the difference between Sections 3.8.6 and 3.8.7?

Attachment A, Scope of Work, Section

3.8.6 pertains to TIPs, and section 3.8.7 pertains to CTI data feeds.

9 Section 3.9.5: Can we assume that the IAM solution doesn't necessarily have to have PAM capabilities? Alternatively, can we submit separate solutions for IAM and PAM?

Please refer to Attachment C, Evaluation Criteria.

10 3.7.2

Will content for any regions outside of North America need to be cached? If so, which ones (South America, Europe, Asia)?

This RFP will result in a state term contract for the state of Florida. Cache requirements will vary from Customer to Customer.

11 3.7.4

Will all of the desired DDoS protected hosts be front-ended by one or more F5 Distributed Cloud (XC) services, such as WAF/WAAP,CDN, etc? If so, they are automatically protected from volumetric DDoS attacks. If not, then traffic from separate customer-owned IP networks (minimum /24) can be scrubbed by F5 (via BGP advertisement), and the clean traffic subsequently returned to the customer (GRE tunnel is most common). If this is the intended scenario, how much clean traffic is desired (in Mbps/Gbps)?

This RFP will result in a state term contract for the state of Florida. Hosts to be protected and their respective configurations will vary from Customer to Customer.

12 3.7.5

How many FQDNs will require WAF/WAAP protection?

This RFP will result in a state term contract for the state of Florida. FQDNs that require WAF/WAAP will vary from Customer to Customer.

13 1. Is it the State's preference to have manufacturers to respond to this RFP?

The State does not have a preference.

14 2. Would the State please extend the due date for submissions to provide time to review and incorporate any and all new information that is released from the questions and answer period?

Please see Section 1.1, Timeline Revision in the 1.

15 3. Attachment D, Section 7.4, Item 7.4.1 "Subcontractors"

Question: Is the State open to receiving responses from manufacturers that provide all authorized contract users the ability to work with authorized resellers of the products included in the response?

Resellers must be approved by the Department prior to utilization. Please refer to section 7.4.1 of Attachment D, Enterprise Standard Terms and Conditions. Respondents should only provide the documents required by the solicitation.

16 4. Attachment "L" files The character limits in Attachments L1- L16, Technical Attachments, and

Question: Please provide further clarity on the character limits allowed in this document. Specifically, does the character limit cited for each section include or not include spaces?

Attachment M, Experience, includes spaces.

17 5. Attachment "B", Price Proposal File

Question: Would the State be agreeable to receiving responses that utilize a minimum discount off of list methodology?

Please refer to Attachment B, Price Proposal, specifically: “Provision of not-to-exceed pricing and tiered pricing is not a mandatory requirement, but will result in the Respondent receiving a higher Price Proposal score, as further explained in Attachment C, Evaluation Criteria.”

18 Question: In lieu of responses for every potential sku available that fulfills a specific Service Category, would the state accept a blanket response to the Service Category?

Example: Response includes all items in a specific portfolio such as "Manufacturer XYZ Email Solutions"

No. Respondents shall provide the applicable Attachment L, Technical Response for each proposed Solution.

19 Question: Is the State open to receiving offers that include a balance of line option to include the States option to add or change product categories based on future need?

No.

20 For Attachment B - Price Proposal - Are we able to submit a percentage off list price rather than price per unit?

Please refer to Attachment B, Price Proposal, specifically: “Provision of not-to-exceed pricing and tiered pricing is not a mandatory requirement, but will result in the Respondent receiving a higher Price Proposal score, as further explained in Attachment C, Evaluation Criteria.”

21 The initial term is 2 years, what is the renewal term? I reviewed Attachments D & E as well as PUR 1000 but I am not clear on what the actual renewal terms are.

The term contract resulting from this RFP can be renewed in whole or in part in accordance with section 287.057(13), F.S..

22 Which agencies/departments are eligible to purchase from this contract?

Please refer to Rule 60A-1.001(3), F.A.C., and the definition of Customer in Attachment D, Enterprise Standard Terms and Conditions.

23 To ensure we are providing a comprehensive response, would the State be willing to grant a 2 business week due date extension given the addition of 8 new service categories?

Please see Section 1.1, Timeline Revision, in the Addendum 1.

24 On the pricing response, would the state be willing to accept a blanket "Cost Plus Markup" or "Discount Off List" as the Not to Exceed pricing structure?

Thanks, No.

25 1.Document Reference: RFP Section 1.1 (Timeline of Events): Due to the timing and nature of this event with 16 categories, will DMS consider moving the response submission date to Dec 6thto allow respondents to engineer an integrated enterprise level solution accommodating multiple service categories.

Please refer to section 1.1, Timeline Revision, in the Addendum 1.

26 General Proposal and Submission Requirements 2.Document Reference: RFP Section 1.5 (Scope of Work): Assuming this RFP is for vendors to submit either products or services for a category or a combination of both. However, many of the responses are centered around a product. If we only provide a service which excludes any specific product, how do we respond if no product is proposed?

Respondents must propose a Solution.

27 3.Document Reference: RFP Section 2.9 (Basis of Award): For respondents proposing solutions across multiple categories, should separate documentation be submitted for each category within Attachments B (Price Proposal) and M (Experience), or is a consolidated submission format allowed?

Respondents should only provide one Attachment M, Experience, regardless of the number of Solutions proposed and regardless of the number of Service Categories that Solutions are proposed for. The Attachment M, Experience, includes a narrative of the Respondent’s relevant experience for the proposed Service Category(ies).

Respondents shall provide one Attachment B, Price Proposal, for each Solution proposed for a given Service Category.

28 4.Document Reference: RFP Section 3.1 (General Instructions): If a respondent submits multiple solutions within a category (e.g., for Endpoint Detection and Response), does each solution require a separate Attachment M (Experience) document, or can all solutions under one category be combined in a single experience summary?

Respondents should only provide one Attachment M, Experience, regardless of the number of Solutions proposed and regardless of the number of Service Categories that Solutions are proposed for. The Attachment M, Experience, includes a narrative of the Respondent’s

29 Pricing Structure and Format 5.Document Reference: RFP Attachment B (Price Proposal): Since the pricing template appears focused on product pricing, can vendors proposing only services modify Attachment B to reflect service rates without specific product details?

Respondents must propose a Solution.

30 Document Reference: RFP Attachment B (Price Proposal): If tiered pricing is relevant to a category response, should vendors include all tier levels in a single Attachment B submission, or submit a separate pricing structure document for tiered pricing?

Respondents shall provide all pricing options for a particular Solution in one Attachment B, Price Proposal.

31 6.Document Reference: RFP Attachment B (Price Proposal): If tiered pricing is relevant to a category response, should vendors include all tier levels in a single Attachment B submission, or submit a separate pricing structure document for tiered pricing?

Respondents shall provide all pricing options for a particular Solution in one Attachment B, Price Proposal.

32 7.If a proposed service or product is priced based on volume, what volume quantities should be used for estimation, or should pricing be based on “unlimited” or “enterprise” based pricing models?

Respondents should provide whichever pricing options best represents their proposed Solution.

33 8.Document Reference: Attachment A (Scope of Work): Section 3.16.9, the requirement states “Solution to handle large volumes of data and grow with the organization’s evolving needs”. Based on that statement, what is the current volume of data under management and what is the anticipated rate of growth based on current needs?

This RFP will result in a state term contract for the State of Florida. Current volumes of data and growth rates will vary based on the Customer.

34 9.Document Reference: Attachment A (Scope of Work): Section 3.17.4, the requirement states “Solution should process and analyze large volumes of security data in real time”. Based on that statement, what is the current volume of data under management and what is the anticipated rate of growth based on current needs?

This RFP will result in a state term contract for the State of Florida. Current volumes of data and growth rates will vary based on the Customer.

35 10.Document Reference: Attachment A (Scope of Work): Section 3.17.4, the requirement states “Solution should process and analyze large volumes of security data in real time”. Based on that statement, what is the allowable amount of elapsed processing time considered acceptable to qualify as “in real time”? Is there a defined length of time in seconds, minutes, or hours?

This RFP will result in a state term contract for the State of Florida.

Processing times will be determined at the Purchase Order level.

36 11.Document Reference: Attachment A (Scope of Work): Section 3.17.2, the requirement states “…to ensure long-term retention of logs for compliance purposes”;

please provide an outer limit of the expected term for data retention.

This RFP will result in a state term contract for the State of Florida. Outer limits of data retention will vary based on the Customer. Additionally, please refer to Section 12.1, General Record

Management, of Attachment E, Enterprise Standard Terms and Conditions.

37 Technical and Evaluation Criteria 12.Document Reference: RFP Attachment M (Experience): In cases where multiple solutions are proposed within one category, does the State require separate experience documentation for each solution in Attachment M, or can a single combined experience document be submitted per category?

Respondents should only provide one Attachment M, Experience, regardless of the number of Solutions proposed and regardless of the number of Service Categories that Solutions are proposed for. The Attachment M, Experience, includes a narrative of the Respondent’s

38 13.Document Reference: Attachment A (Scope of Work): Section 3.9, the requirement does not state that the service vendor is required to facilitate or assist in the utilization of the requested IAM service with any customer system or service. Is this an oversight or are there external service enablers that should be considered?

Respondents should provide any add-on services for a proposed Solution in accordance with the instructions for “Add- On Services (OPTIONAL)” in Attachment B, Price Proposal.

39 14.Document Reference: Attachment A (Scope of Work): In reference to section 3.9, what is the anticipated utilization rate of the requested IAM service?

This RFP will result in a state term contract for the state of Florida. Utilization rates will vary based on the Customer.

40 Contract Terms and Award Structure 15.Document Reference: RFP Attachment B (Add-On Services): For the Add-On Services section, does the State expect vendors to list only no-cost services, or may vendors include optional add-on services with associated costs?

Optional add-on services with associated prices are allowed as described in the instructions for “Add-On Services (OPTIONAL)” of Attachment B, Price Proposal.

41 Would Florida be willing to consider an extension to December 9th, 2024?

Please refer to section 1.1, Timeline Revision, in the Addendum 1.

42 Do we need to submit VPATs/LOAs Respondents should provide all information they feel is relevant for a proposed Solution.

43 Are distributors allowed to bid?

a. Attachment D - Enterprise Standard Terms and Conditions .1 Subcontractors must have prior written consent from FL to be on contract - Distributors are listed in the category of subcontractors

Yes.

44 Can we submit resellers with our proposal?

Or only after prior approval, see 7.4.1

Resellers must be approved by the Department prior to utilization. Please refer to section 7.4.1 of Attachment D, Enterprise Standard Terms and Conditions.

45 Can we submit more than one supplier per service category?

Yes.

46 Do we need a separate service category attachment responses per supplier or can we combine responses in each attachment?

Respondents shall provide a completed applicable Attachment L, Technical Attachment, and Attachment B, Price Proposal, for each proposed Solution.

47 If we need a separate service category attachments per supplier what is the preferred naming conventions for the files?

Please refer to Section 1.3, Submission, in the Addendum 1.

48 Please clarify the section on page 19 labeled “Required Documents to be submitted by Respondent prior to RFP opening” – Please define “prior to opening”.

Please refer to RFP Section 2.3, Public Opening. Also please refer to Section 1.1, Timeline Revision, in the Addendum 1.

49 Do we have to submit these documents before the 11/21 deadline?

Please refer to section 1.1, Timeline Revision, in the Addendum 1.

50 Why aren’t all of the forms listed under the required documents or optional documents on page 19? It looks like H and K are missing.

Please refer to RFP Section 2.12, Other Requirements Following Award, regarding reference to Attachment H, Vendor Certification Form.

Additionally, please refer to section 1.2 in the Addendum 1 for reference to Attachment K, PUR 1355, Foreign Country of Concern Attestation Form.

51 Would we be able to add additional resellers and suppliers post-award?

No new Solutions may be added during the term of the State Term Contract.

However, awarded contractors can add or remove subcontractors during the term of the Contract but must be approved by the Department prior to utilization. Please refer to section 7.4.1 of Attachment D, Enterprise Standard Terms and Conditions.

52 If Florida is considering more than one supplier per service category do, we need to submit every part number as part of attachment B?

Provide all relevant information and pricing for a proposed Solution.

54 Also, will Florida consider the addition of parts post award?

No.

55 For the add-on services piece of attachment B, can resellers provide their own services as they relate to the scope of the service categories?

Yes.

56 As an alternative to the tiered pricing system would Florida be amendable to a percentage off MSRP?

Please refer to Attachment B, Price Proposal. Additionally, please refer to Attachment C, Evaluation Criteria.

57 3.8 Service Category 7: Security Operations Platform: Is the state looking for a platform or how products integrate?

This RFP will result in a state term contract for the state of Florida. Specifics to Service Category 7 will be determined by the Customer at the Purchase Order level.

58 3.8 Service Category 7: Security Operations Platform: What is the pricing expectation for L7: Security Operations Platform?

Please refer to Attachment B, Price Proposal. Additionally, please refer to Attachment C, Evaluation Criteria.

59 3.11 Service Category 10: Secure Access Service Edge (SASE): Are there any requirements for tiered pricing in this specific category?

Please refer to Attachment B, Price Proposal. Additionally, please refer to Attachment C, Evaluation Criteria.

60 Attachment M: Do you require Attachment M for each Service Category Responded to?

Respondents should only provide one Attachment M, Experience, regardless of the number of Solutions proposed and regardless of the number of Service Categories that Solutions are proposed for. The Attachment M, Experience, includes a narrative of the Respondent’s

61 May we have a 30 day extension in order to provide a high quality response for the additional set of services and requirements?

Please refer to section 1.1, Timeline Revision, in the Addendum 1.

62 Service Category 13: Vulnerability Assessment and Management

Digital Security Solutions RFP

Is a vulnerability management solution/service currently in place? If so, what is the solution?

This RFP will result in a state term contract for the state of Florida. Existing infrastructure will vary from Customer to Customer.

63 2Service Category 13: Vulnerability Assessment and Management

Digital Security Solutions RFP

What is the current number of vulnerabilities present within the vulnerability management solution?

This RFP will result in a state term contract for the state of Florida. Existing vulnerabilities will vary from Customer to Customer.

64 3Service Category 13: Vulnerability Assessment and Management

Digital Security Solutions RFP

What are the current Service Level Agreements in place for remediation of vulnerabilities per criticality? E.G. what is the time frame a critical vulnerability must be remediated, high, etc.

This RFP will result in a state term contract for the state of Florida. Existing SLAs will vary from Customer to Customer.

65 4Service Category 13: Vulnerability Assessment and Management

Digital Security Solutions RFP

How many vulnerabilities enter the vulnerability management system on a monthly basis?

This RFP will result in a state term contract for the state of Florida.

Vulnerability traffic will vary from Customer to Customer.

66 5Service Category 5 - Email Security

Digital Security Solutions RFP

Are your email services fully handled through the cloud (e.g., Exchange online) or are there any on-prem mail servers we should be aware of?

This RFP will result in a state term contract for the state of Florida. Existing email infrastructure will vary from Customer to Customer.

67 6Service Category 5 - Email Security

Digital Security Solutions RFP

What email security awareness programs are currently in place for employees?

This RFP will result in a state term contract for the state of Florida. Existing email security awareness programs will vary from Customer to Customer.

68 7Service Category 5 - Email Security

Digital Security Solutions RFP

Are there specific departments or units with higher email traffic or unique requirements?

This RFP will result in a state term contract for the state of Florida. Email traffic will vary from Customer to Customer.

69 8Service Category 5 - Email Security

Digital Security Solutions RFP

Are there other security tools or platforms that the email security solution must integrate with?

This RFP will result in a state term contract for the state of Florida. Existing tools will vary from Customer to Customer.

70 9Service Category 5 - Email Security

Digital Security Solutions RFP

Are there any recent incidents or breaches related to email security that we should be aware of?

This RFP will result in a state term contract for the state of Florida. Recent incidents will vary from Customer to Customer.

71 10Service Category 11 - GRC

Digital Security Solutions RFP

What Governance Risk Compliance tool is currently been leveraged for risk register and controls management lifecycle

This RFP will result in a state term contract for the state of Florida. Existing GRC tools will vary from Customer to

72 11Service Category 11 - GRC

Digital Security Solutions RFP

What are the in-scope data sources for the GRC solution?

This RFP will result in a state term contract for the state of Florida. Data sources will vary from Customer to Customer.

73 12Service Category 11 - GRC

Digital Security Solutions RFP

Are there any tools currently leveraged for risk aggregation or risk quantification? Is yes, please provide the name of the solution/s.

This RFP will result in a state term contract for the state of Florida. Existing tools will vary from Customer to Customer.

74 13Service Category 11 - GRC

Digital Security Solutions RFP

How does Florida DMS plan to sustain and evolve the GRC program post-implementation?

This RFP will result in a state term contract for the state of Florida. GRC needs will vary from Customer to Customer.

75 14Service Category 11 - GRC

Digital Security Solutions RFP

Is there a current risk assessment methodology adopted by Florida DMS?

This RFP will result in a state term contract for the state of Florida. Current risk assessment methodology will vary based on the Customer.

76 15Service Category 11 - GRC

Digital Security Solutions RFP

Are there any particular regulations which Florida DMS would like to prioritize the tracking of in the GRC solution?

This RFP will result in a state term contract for the state of Florida.

Prioritization of tracking will vary from Customer to Customer.

77 16Service Category 15 - Data Security

Digital Security Solutions RFP

Are the current DLP tools in active or passive mode?

This RFP will result in a state term contract for the state of Florida.

Configuration of current DLP tools will vary from Customer to Customer.

78 17Service Category 15 - Data Security

Digital Security Solutions RFP

What are the main repositories in use for stuctured (On-Prem databases, Azure SQL, etc.) and unstructured data (e.g., network file shares, SharePoint, DropBox, etc.)

This RFP will result in a state term contract for the state of Florida. Existing repositories will vary from Customer to

79 18Service Category 15 - Data Security

Digital Security Solutions RFP

Does the State of Florida currently possess Microsoft E5 licenses?

This RFP will result in a state term contract for the state of Florida. Existing Microsoft E5 licenses will vary from Customer to Customer.

80 19Service Category 15 - Data Security

Digital Security Solutions RFP

Are there any solutions currently in place for data classification/discovery?

This RFP will result in a state term contract for the state of Florida. Existing Solutions will vary from Customer to Customer.

81 20Service Category 15 - Data Security

Digital Security Solutions RFP

What endpoint protection solution is currently in place? Is endpoint DLP in place?

This RFP will result in a state term contract for the state of Florida. Existing Solutions will vary from Customer to Customer.

82 21Service Category 15 - Data Security

Digital Security Solutions RFP

How many types of sensitive data (e.g., PII, PHI, financial data) will need to be identified and protected under the data protection program?

This RFP will result in a state term contract for the state of Florida. Types of data to be secured will vary from Customer to Customer.

83 22Service Category 15 - Data Security

Digital Security Solutions RFP

Does Florida DMS have an approved policy for classifying data by its level of sensitivity that is aligned to types of data (e.g., PII, PHI, etc.)?

This RFP will result in a state term contract for the state of Florida. Existing infrastructure will vary from Customer to Customer.

84 23Service Category 15 - Data Security

Digital Security Solutions RFP

Is there an existing process in place for dealing with DLP alerts when they occur?

This RFP will result in a state term contract for the state of Florida. Existing processes will vary from Customer to Customer.

85 24Service Category 15 - Data Security

Digital Security Solutions RFP

Can Florida DMS provide insights into any previous or ongoing efforts to protect sensitive data that the DLP/data security initiative should build upon (e.g. what is

This RFP will result in a state term contract for the state of Florida. Existing infrastructure will vary from Customer to working well and should / could be modeled)?

86 25Service Category 15 - Data Security

Digital Security Solutions RFP

Can you detail any specific encryption technologies currently in use or desired for future implementation?

This RFP will result in a state term contract for the state of Florida. Existing encryption technologies will vary from Customer to Customer.

87 26Service Category 15 - Data Security

Digital Security Solutions RFP

Does Florida DMS currently employ any Insider Threat or User and Entity Behavior Analytics (UEBA) tools?

This RFP will result in a state term contract for the state of Florida. Existing UEBA tools, if any, will vary from Customer to Customer.

88 27Service Category 15 - Data Security

Digital Security Solutions RFP

Are there particular data assets or repositories that you're prioritizing for encryption coverage expansion?

This RFP will result in a state term contract for the state of Florida. Data assets will vary from Customer to Customer.

89 28Service Category 15 - Data Security

Digital Security Solutions RFP

Does Florida DMS have an approved policy for classifying data by its level of sensitivity aligned to types of data, and what data types are in-scope as highly sensitive?

This RFP will result in a state term contract for the state of Florida. Existing policy will vary from Customer to Customer.

90 29Service Category 15 - Data Security

Digital Security Solutions RFP

Has Florida DMS established approved guidelines on how to handle data based on its classification? For example, rules on encryption, approved cloud repositories, etc.

This RFP will result in a state term contract for the state of Florida. The data classification will vary from Customer to Customer.

91 30Service Category 15 - Data Security

Digital Security Solutions RFP

How many existing infrastructure and systems (e.g., email servers, file repositories, network access points) need to be integrated with the DLP/data security solution?

This RFP will result in a state term contract for the state of Florida. Existing infrastructure will vary from Customer to

92 31Service Category 12 - ITSM

Attachment L12 - Service Category 12 Response

Regarding Prompt 2 "Solution should detect, categorize, and prioritize IT incidents based on predefined rules."

We are looking to clarify the 'detection' in this context: The detection of Incidents typically sits within Monitoring tooling/agents, which then feed into Event capabilities to allow correlation &

filtering, which then integrate with the Incident Management Workflow solution. We assume multiple monitoring toolings integrate with the Incident Management Workflow solution, as these are often technology dependent. Note that you are asking for Pre-built integrations with Monitoring in Prompt 7. Our questions:

- Can we assume that Monitoring capabilities will be existing systems that need to be integrated (see Prompt 7 ITSM) and thus are NOT part of the Incident Management Workflow solution?

- Are you looking for Event Management capabilities such as correlation &

filtering in the Incident Management Workflow Solution?

Provide all relevant information for a proposed Solution.

Additionally, this RFP will result in a state term contract for the state of Florida.

Specific Customer needs will vary based on the Customer.

93 32Service Category 12 - ITSM

Attachment L12 - Service Category 12 Response

Regarding "Prompt 5: Configuration Management Database (CMDB)" .

Understanding that Category 1/2/3 cover a form of Discovery from a Security perspective, would you also require discovery capabilities from a CMDB perspective within this solution?

Provide all relevant information for a proposed Solution.

94 33Service Category 12 - ITSM

Attachment L12 - Service Category 12 Response

Is your expectation the the ITSM Solution is a centralized single instance solution for all subscribing departments; or do you expect each subscribing department will require their own decentralized instance; or do you expect some departments to use a centralized instance and others to use their own dedicated instance?

This RFP will result in a state term contract for the state of Florida. Existing infrastructure will vary based on the Customer.

95 34Service Category 12 - ITSM

Attachment L12 - Service Category 12 Response

Re. Prompt 7 "Pre-built integration" - Do you have a list of existing solutions that should be integrated with? We understand a full list may not be available, so a subset of most commonly/most-widely used solutions would help.

This RFP will result in a state term contract for the state of Florida. Existing Solutions will vary based on the Customer.

96 35General

Digital Security Solutions RFP

Would DMS consider extending the proposal submission date to allow for addressing the comprehensive list of Service Categories in the RFP?

Please refer to section 1.1, Timeline Revision, in the Addendum 1.

97 36General

Digital Security Solutions RFP

For Service Categories 8 (IAM), 11 (GRC), and 12 (ITSM), could DMS provide the scoping parameters to help us price the cost of the product and the services associated with it?

This RFP will result in a state term contract for the state of Florida. Specific scoping parameters will vary based on the Customer.

98 37General

Digital Security Solutions RFP

Can the vendor provide a rate card for the implementation or managed services associated with a given category in the pricing section?

Please refer to Attachment B, Price Proposal.

99 Will FLDS provide sizing guidelines around tiered pricing?

Tiered pricing is to be determined by the Respondent.

100 Overarching Question - Can offshore resources be leveraged?

No. Please see Section 13, Data Security, of Attachment D, Enterprise Standard Terms and Conditions.

101 Overarching Question - Will a managed service be allowed for this response?

Respondents must submit a Solution.

102 Service Category 11 - Where are policies stored within your organization?

This RFP will result in a state term contract for the state of Florida. Policy Storage of policies will vary based on the

Service Category 11 - Will we need to integrate with UCF for this?

This RFP will result in a state term contract for the state of Florida.

Integrations will vary based on the Customer.

Additionally, Customer means the agency, as defined in section 287.012, F.S., or eligible user, as defined in Rule 60A-1.001, Florida Administrative Code (“F.A.C.”), that makes a purchase off the Term Contract. For the avoidance of doubt, this also includes the Department when it purchases off the Term Contract.

104 Service Category 11 - Are your risks already defined in your organization or will that be in scope for this implementation?

This RFP will result in a state term contract for the state of Florida. Known risks will vary based on the Customer.

105 Service Category 11 - Are there any specific frameworks we should be aware of?

This RFP will result in a state term contract for the state of Florida. Existing framework will vary based on the Customer.

106 Service Category 11 - What risk assessment tools need to be integrated with?

This RFP will result in a state term contract for the state of Florida. Risk assessment tools will vary based on the Customer.

107 Service Category 11 - What audits will be in scope for this engagement? (i.e. PCI, SOC, ISO, etc.)

This RFP will result in a state term contract for the state of Florida. In scope audits will vary based on the Customer.

108 Service Category 11 - Where is vendor data stored for Third party risk management?

This RFP will result in a state term contract for the state of Florida. Existing data storage will vary based on the Customer.

109 Service Category 11 - How many questionnaires are in scope for TPRM?

This RFP will result in a state term contract for the state of Florida. In scope questionnaires will vary based on the Customer.

110 Service Category 12 - What systems are automatically creating incidents? Will all be in scope for the initial release?

This RFP will result in a state term contract for the state of Florida. Existing systems creating incidents will vary based on the Customer.

111 Service Category 12 - Will there be a migration of data from the legacy system(s)?

This RFP will result in a state term contract for the state of Florida. Legacy system migration will vary based on the Customer.

112 Service Category 12 - Where is knowledge currently stored?

This RFP will result in a state term contract for the state of Florida. Existing knowledge storage will vary based on the Customer.

113 Service Category 12 - Are there existing processes for change management?

This RFP will result in a state term contract for the state of Florida. Existing process change management will vary based on the Customer.

114 Service Category 12 - Have the SLAs been defined previously?

This RFP will result in a state term contract for the state of Florida. SLAs will vary based on the Customer.

115 Service Category 12 - What are the prebuilt integrations? AD, Teams, etc.?

This RFP will result in a state term contract for the state of Florida Prebuilt integrations will vary based on the Customer.

116 Service Category 12 - What are the CTI systems?

This RFP will result in a state term contract for the state of Florida. CTI systems will vary based on the Customer.

117 -Does the department want respondants to combine all technical response attachments across multiple categories and solutions inton one document for submission? Or does the department want respndants to upload a separate document for each technical response to each category for each solution?

Respondents shall provide a completed applicable Attachment L Technical Response for each Solution proposed.

Additionally, please refer to section 1.3, Submission, in the Addendum 1.

118 -The pricing attachment asks respondants to provide price proposals in a .pdf format.

Does the department want respondants to combine all pricing documents for various categories and solutions into one .pdf, or a separate .pdf for each solution?

Respondents shall provide an Attachment B, Price Proposal ,per Solution proposed.

Additionally, please refer to section 1.3, Submission, in the Addendum 1.

119 Does the department want respondants to upload separate attachment Ms, for all solutions/categories being offered, or combine expereince experience responses across all solutions being offered into one document?

Respondents should only provide one Attachment M, Experience, regardless of the number of Solutions proposed and regardless of the number of Service Categories that Solutions are proposed for. The Attachment M, Experience, includes a narrative of the Respondent’s relevant experience for the proposed Service Category(ies).

120 1. How many Windows, Linux, MAC workstations/desktops/laptops are in scope?

This RFP will result in a state term contract for the state of Florida. Existing devices will vary based on the Customer.

121 2. How many Windows and Linux servers in scope?

contract for the state of Florida.

Operating systems will vary based on the Customer.

122 3. How many endpoints do you currently manage within your organization?

This RFP will result in a state term contract for the state of Florida. Endpoints will vary based on the Customer.

123 4. What is your budget? This RFP will result in a state term contract for the state of Florida. Budgets will vary based on the Customer.

124 5. What is your timeline for evaluating and implementing a EPM solution?

This RFP will result in a state term contract for the state of Florida.

Timelines will vary based on the Customer.

125 6. What is your timeline for procuring a solution?

This RFP will result in a state term contract for the state of Florida.

Procurement timelines will vary based on the Customer.

126 7. Regarding the duration of the contract, what term length would you prefer in the quote: 1 year, 3 years, or 5 years?

Please refer to Attachment E, Draft Contract, for the contract term. The duration of a Customer specific contract may be outlined in the Customer SOW.

See Attachment A, Scope of Work, section 4.1, Customer Specific Scope of Work (SOW).

127 1 What is your timeline for implementing an Access and Identity Management solution?

This RFP will result in a state term contract for the state of Florida.

Timelines will vary based on the Customer.

128 2 What is your budget for this project? See response to question 123.

129 3 What is your timeline or objective for procuring an IAM solution?

See response to question 124.

130 4 What is your timeline for evaluating and implementing a IAM solution?

See response to question 124.

131 5 Regarding the duration of the contract, what term length would you prefer in the quote: 1 year, 3 years, or 5 years?

See response to question 126.

132 6 Authentication Management -- B2E / Employee / Workforce Users: Authorized Users that are employees of Customer or its Affiliates. How many Users are Business to Employees (B2E) or full-time employees?

This RFP will result in a state term contract for the state of Florida. The number of users vary based on the Customer.

133 7 Authentication Management -- B2B / Partner Users: Authorized Users that are third- party consultants, contractors, or vendors of Customer or its Affiliates. How many Users are Business to Business (B2B) third-party contractors and vendors?

See response to question 132.

134 8 Authentication Management -- B2C / Customer Users: Customer’s customers/consumers who utilize a service offered by Customer or its Affiliates. How

See response to question 132.

many Users are Business to Consumer/Customer (B2C)?

135 Will a Security Operations Platform that REQUIRES an associated Managed Services contract be considered?Is the state open to leveraging vendor provided Cyber Threat Intelligence (CTI) in the offered by the Security Operations Service? Is integration with exiting CTI feeds a requirement?

Provide all relevant information related to a proposed Solution. If additional add-ons are required, include those additional add-ons in Attachment B, Price Proposal.

Additionally, this RFP will result in a state term contract for the state of Florida.

Existing CTI feeds will vary based on the Customer.

135 the word documents provided (attachment L3) are giving us problems when trying to input our responses to the prompts. For example prompt 1 is not allowing up to 3,000 characters max as stated. I noticed it is set to review mode and not edit mode.

Can you please turn off track changes and set it to edit mode and reissue the attachments? When we try to input responses sometimes it jumps to the next prompt when trying to respond to a different prompt.

Attachments L1-L16, Technical Response Attachment documents were created in Microsoft Word. The Department is unable to recreate this issue.

136 in order to allow time fot q&a responses and factoring in the holiday on November 11, can you please grant an extension to the due date?

Please refer to section 1.1, Timeline Revision, in the Addendum 1.

137 Questions from BigID for Service Category 15 Response (Data Security):

What frameworks are you expecting/requiring integration with, and can you describe what level of integration are you expecting/requiring?

What specific compliance requirements are in scope? What compliance management platform are you referring to regarding integration? What ETL solutions are you referring to for an integration?

This RFP will result in a state term contract for the state of Florida.

Frameworks, integration and compliance requirements will vary based on the Customer.

138 For the Pricing requirement, if we propose a subset of our Professional Services offerings geared towards many of our existing public sector customers, would we have the ability to add other, similar PS offerings during the term of the contract if requested by a State agency?

No.

139 For the actual SOW agreement tied to these service engagements, that can be developed with each individual agency, Respondents must propose a Solution and include any information they feel is relevant to its proposed Solution. Please correct? Or are any general terms of these service offerings required to be included as a part of our initial response to the RFP?

refer to Section 2, Service Level Agreement or Additional Terms and Conditions, of Attachments L1-L16, Technical Attachments. Customer specific contract terms may be outlined in the Customer SOW. See Attachment A, Scope of Work, section 4.1, Customer Specific Scope of Work (SOW)..

140 Can the RFP response be submitted by an authorized Commvault distributor who will manage VARs/resellers through an authorized agent model to extend broader coverage to the State to purchase?

Yes. Please refer to section 7.4,1 of Attachment E, Enterprise Standard Terms and Conditions.

141 How does the State foresee a SASE solution being able to function as described in this RFP, considering the technical and contractual limitations of the MyFlorida Network?

This solicitation will result in a statewide contract for the state of Florida. Customer needs and existing framework will vary based on the Customer.

142 Should alternative connectivity solutions like broadband and direct internet access be included in the SASE category for remote site connectivity?

Respondents should include any information they feel is relevant to its proposed Solution.

143 Does the State expect manufacturers to submit responses and down-select authorized resellers for this contract?

Manufacturers, resellers, and other vendors may submit responses. Please also refer to section 7.4,1 of Attachment E, Enterprise Standard Terms and Conditions.

144 Does the State intend to award multiple resellers for a single vendor in any of the proposed categories?

Please refer to Section 2.6, Basis of Award, of the RFP document.

145 What is the process for updating product SKUs for selected technologies as the cybersecurity vendors sunset those line items as the product evolves to address new threats and offer new features?

No new Solutions may be added during the term of the State Term Contract.

However, the Department will work with Contractors if service availability changes during the term of the State Term Contract.

146 How will the state address the SKUS on the product list that could become end-of-life during the contract's life?

The Department will work with Contractors if service availability changes during the term of the State Term Contract.

147 If there is a process to update SKUS during the contract's life, how will the State decide the new SKU contract pricing?

No new Solutions may be added during the term of the State Term Contract.

However, the Department will work with Contractors if service availability changes during the term of the State Term Contract.

Additionally, please refer to Attachment B, Pricing Proposal.

148 Will the state require services tied to a product sale or can they use this contract for services-only procurement?

Respondents must propose a Solution.

149 Will there be a process to add additional manufacturers and resellers to the contract once awarded to address new threats and technologies that emerge over the life of the contract?

Awarded contractors can add or remove subcontractors during the term of the Contract. Please refer to section 7.4.1 of Attachment D, Enterprise Standard Terms and Conditions.

No additional Contractors will be added during the term of the Contract.

150 What are the number of endpoints for the project(s) or service(s)?

contract for the state of Florida. The number of endpoints will vary based on the Customer.

151 What is the ITSM system? This RFP will result in a state term contract for the state of Florida. ITSM systems will vary based on the Customer.

152 Would the scope be agent-based or agentless scanning?

This RFP will result in a state term contract for the state of Florida. Agent-based vs agentless will vary based on the Customer.

153 -Within the various Service Category Response documents, are images allowed?

If so, do images count toward the character limits?

Images are not accepted.

154 Our question is to help with quoting our solution. We license based on the # of users. Do you know how many people at Florida Department of Management Services would need to be license?

This RFP will result in a state term contract for the state of Florida. The amount of users vary based on the Customer.

156 Will the RFP be published in the Business Network Ariba portal or will DMS update the response submission instructions?

The RFP is active in the Business Network. Please refer to section 3.3, How to Access the Sourcing Event In MyFloridaMarketPlace.

157 DMS previously published RFP No. 24- 43230000-RFP, received proposals from vendors, and then rejected all proposals. For the new RFP (No. 24-43230000-RFP-2), Service Categories 1 – 7 appear to be the same, with a different response template and questions. Will DMS describe the difference of intent or structure with the current RFP (No. 24-43230000-RFP-2) from the previous RFP (No. 24-43230000-RFP)?

Please refer to the solicitation documents for more information.

158 Will DMS accept multiple manufacturers’ submissions per Service Category per Respondent? If so, is there a suggested format for submitting multiple manufacturers responses in the portal? (In the previous RFP #24-43230000-RFP, all responses for a service category had to be combined into one file per Service Category.)

Respondents can submit multiple Solutions per Service Category. Please refer to section 1.3, Submission, in the Addendum. 1

159 Is the 1000 word limit in Attachment M per service category or in total?

Respondents should only provide one Attachment M, Experience, regardless of the number of Solutions proposed and regardless of the number of Service Categories that Solutions are proposed for. The Attachment M, Experience, includes a narrative of the Respondent’s

160 Would the Department consider exceptions to the Special Terms and Conditions?

No.

161 Can vendors respond with multiple solutions for the same domain? If so, should multiple attachments for that same category be submitted?

Respondents can submit multiple Solutions per Service Category.

Additionally, please refer to section 1.3, Submission in the Addendum 1.

162 How would the State prefer vendors to address domains that require multiple solutions to meet all requirements? Should the vendor submit a single attachment for that domain with an integrated solution, or multiple attachments specifying which solution addresses each requirement?

Provide all relevant information for a proposed Solution.

If a Solution meets the requirements of multiple Service Categories, the applicable Attachment L, Technical Response for each applicable Service Category shall be submitted. Each Service Category includes a detailed description of the Solution’s purpose that a Solution must address, followed by a section which includes “Solutions should provide”, which lists the technical capabilities and features that are generally expected for a Solution. Please also refer to Attachment C, Evaluation Criteria.

Additionally, please refer to section 1.3, Submission, in the Addendum 1.

163 If a vendor has a solution that meets most, but not all, of the requirements, can they still submit a response, or would this result in automatic disqualification for that domain?

Yes, Respondents can submit a response, but potentially may not be awarded. Please refer to Attachment C, Evaluation Criteria.

164 Should options from vendor solutions include on-premise and cloud options broken our separately for a service category provide all relevant information for a proposed Solution.

or can these be combined into one response?

165 Are there specific baseline regulations that all service categories must adhere (e.g.., StateRAMP)?

This RFP will result in a state term…