Amendment 1.docx

SAP

State of South Carolina

Request for Proposal Amendment #1

Solicitation:

Date Issued:

Procurement Officer:

Phone:

E-Mail Address:

Mailing Address:

5400021812 08/18/2021

ZACHARY YARBROUGH

803-896-0284 zyarbrough@mmo.sc.gov SFAA, Office of Procurement Services 1201 Main Street, Suite 601 Columbia SC 29201

DESCRIPTION: MITRE ATT&CK™ ASSESSMENT

USING GOVERNMENTAL UNIT: SOUTH CAROLINA DEPARTMENT OF REVENUE (SCDOR)

SUBMIT YOUR OFFER ON-LINE AT THE FOLLOWING URL: http://www.procurement.sc.gov

SUBMIT OFFER BY (Opening Date/Time): 09/03/2021 @ 1100 ET (See "Deadline For Submission Of Offer" provision)

QUESTIONS MUST BE RECEIVED BY: 08/10/2021 @ 1600 ET (See "Questions From Offerors" provision)

NUMBER OF COPIES TO BE SUBMITTED: One (1) on-line submission and, if necessary, One (1) Redacted Copy submitted online.

Initial here if NO redacted copy is necessary___________

CONFERENCE TYPE: Pre-Proposal

DATE & TIME: 08/10/2021 @ 1000 ET

(As appropriate, see "Conferences - Pre-Bid/Proposal" & "Site Visit" provisions) LOCATION: Tele-conference

You must submit a signed copy of this form with Your Offer. By signing, You agree to be bound by the terms of the Solicitation. You agree to hold Your Offer open for a minimum of ninety (90) calendar days after the Opening Date. (See "Signing Your Offer" provision.)

NAME OF OFFEROR

(full legal name of business submitting the offer) Any award issued will be issued to, and the contract will be formed with, the entity identified as the Offeror. The entity named as the offeror must be a single and distinct legal entity. Do not use the name of a branch office or a division of a larger entity if the branch or division is not a separate legal entity, i.e., a separate corporation, partnership, sole proprietorship, etc.

AUTHORIZED SIGNATURE

(Person must be authorized to submit binding offer to contract on behalf of Offeror.)

DATE SIGNED

TITLE

(business title of person signing above)

STATE VENDOR NO.

(Register to Obtain S.C. Vendor No. at www.procurement.sc.gov)

PRINTED NAME

(printed name of person signing above)

STATE OF INCORPORATION

(If you are a corporation, identify the state of incorporation.)

OFFEROR'S TYPE OF ENTITY: (Check one) (See "Signing Your Offer" provision.)

___ Sole Proprietorship ___ Partnership ___ Other_____________________________

___ Corporate entity (not tax-exempt) ___ Corporation (tax-exempt) ___ Government entity (federal, state, or local)

COVER PAGE - ON-LINE ONLY (MAR. 2015)

SAP

SAP

PAGE TWO

(Return Page Two with Your Offer) HOME OFFICE ADDRESS (Address for offeror's home office / principal place of business)

NOTICE ADDRESS (Address to which all procurement and contract related notices should be sent.) (See "Notice" clause)

_________________________________________________ Area Code - Number - Extension Facsimile

_________________________________________________ E-mail Address

PAYMENT ADDRESS (Address to which payments will be sent.) (See "Payment" clause)

____Payment Address same as Home Office Address ____Payment Address same as Notice Address (check only one) ORDER ADDRESS (Address to which purchase orders will be sent) (See "Purchase Orders and "Contract Documents" clauses)

____Order Address same as Home Office Address ____Order Address same as Notice Address (check only one)

ACKNOWLEDGMENT OF AMENDMENTS

Offerors acknowledges receipt of amendments by indicating amendment number and its date of issue. (See "Amendments to Solicitation" Provision)

DISCOUNT FOR PROMPT PAYMENT

(See "Discount for Prompt Payment" clause)

PREFERENCES - A NOTICE TO VENDORS (SEP. 2009): On June 16, 2009, the South Carolina General Assembly rewrote the law governing preferences available to in-state vendors, vendors using in-state subcontractors, and vendors selling in-state or US end products. This law appears in Section 11-35-1524 of the South Carolina Code of Laws. A summary of the new preferences is available at www.procurement.sc.gov/preferences. Per 11-35-1524(E) Preferences do not apply.

AMENDMENTS TO SOLICITATION (JAN 2004)

The Solicitation may be amended at any time prior to opening. All actual and prospective Offerors should monitor the following web site for the issuance of Amendments: www.procurement.sc.gov (b) Offerors shall acknowledge receipt of any amendment to this solicitation (1) by signing and returning the amendment, (2) by identifying the amendment number and date in the space provided for this purpose on Page Two, (3) by letter, or (4) by submitting a bid that indicates in some way that the bidder received the amendment. (c) If this solicitation is amended, then all terms and conditions which are not modified remain unchanged. [02-2A005-1]

The clause titled “QUALIFICATIONS - SPECIAL STANDARDS OF RESPONSIBILITY (MAR 2015)” is hereby amended as follows

(a) This section establishes special standards of responsibility. UNLESS YOU POSSESS THE FOLLOWING MANDATORY MINIMUM QUALIFICATIONS, DO NOT SUBMIT AN OFFER:

1. Offerors must have successfully performed at least three (3) MITRE ATT&CK assessments. Offeror’s experience may be supplemented with the previous experience of the Offeror’s employees IF the employees were employed prior to the July 28, 2021.

(b) Provide a detailed, narrative statement with adequate information to establish that you meet all the requirements stated in subparagraph (a) above. Include all appropriate documentation. If you intend for us to consider the qualifications of your key personnel, predecessor business (es), or subcontractor(s), explain the relationship between you and such person or entity. [R. 19-445.2125(F)] [05-5010-2]

QUESTIONS FROM OFFERORS - AMENDMENT (JUN 2017)

The solicitation is amended as provided herein. Information or changes resulting from questions will be shown in a question-and-answer format. All questions received have been reprinted below. The “state’s response” should be read without reference to the questions. The questions are included solely to provide a cross-reference to the potential Offeror that submitted the question. Questions do not form a part of the contract; the “state’s response” does. Any restatement of part or all of an existing provision of the solicitation in an answer does not modify the original provision except as follows: underlined text is added to the original provision. Stricken text is deleted. [02-2A097-1]

1. Has SCDOR used ATT&CK at all?

SCDOR has developed a limited knowledge of the MITRE ATT&CK framework in researching the requirements but has yet to implement the framework in a meaningful way.

2. Your list on the infrastructure needs clarification. What is the Operating System on the servers you mention (800 of them) for the assessment?

The SCDOR domain operating system is based on Windows Server and Linux based.

3. Can you tell us where you have Active Directory installed?

Active Directory is installed on–prem within the State datacenter.

4. Where are you using Software as a Service (SaaS) on your infrastructure?

The current SaaS usage is limited to specific sub-sets of users for targeted point solutions. Access to a particular SaaS solution is limited to less than 20 users.

5. You would like 8 hours of training? Are you requesting that a training module be developed specifically for the SCDOR team for current and future training? The 8 hours would be a first instance of use for that material. The requirement for 8 hours of training is to introduce and familiarize the security team in the use of the MITRE ATT&CK framework.

6. Regarding the State of South Carolina Department of Revenue's request for vendors to reference three previous engagements where the MITRE ATT&CK Framework elements were utilized; it is assumed that any past performance of MITRE ATT&CK Framework versions will meet your requirement. New versions are continually updated. Is that correct?

With regard to QUALIFICATIONS – REQUIRED INFORMATION, Offerors shall submit “the three most recent, comparable contracts”. Pertaining to QUALIFICATIONS - SPECIAL STANDARDS OF RESPONSIBILITY, Offerors shall submit documentation for the most recent MITRE ATT&CK assessments.

7. Is there an incumbent?

No, there is not an incumbent.

8. While penetration testing is out of scope, will SCDOR allow technical testing user adversary emulation tools and other tools commonly used by malware and advanced persistent threats (APTs) to test for existing security tool effectiveness and gaps? Or, does SCDOR prefer the assessment remain non-technical?

SCDOR acknowledges the relationship between penetration testing and the MITRE ATT&CK framework assessment but, the inclusion of pen testing activities is stated as “out of scope” and therefore, will not be considered in the scoring process.

9. Do you have an approximate budget, or a budget range for the entire project?

The budget for this solicitation will not be released.

10. Since we are a new, start-up company, in lieu of past financial records, would a Surety Bond for both the bid and the performance of the work suffice and be an acceptable alternative?

Offerors should submit financial information to assure the State that the Offeror has the capability to perform fully the contract requirements. Please see the clauses titled “QUALIFICATIONS -- REQUIRED INFORMATION (MAR 2015)” and “QUALIFICATIONS OF OFFEROR (MAR 2015)”

11. Conduct an assessment of the current security tool set for coverage and gaps in defense.

a. Is this assessment to be conducted purely from documentation, surveys and interviews or will it also include validation of controls?

Assessment will be conducted from documentation, surveys and interviews.

1) If Control Validation is required, will we be provided necessary access to perform adequately?

Control Validation is not required.

b. Is this the first time this assessment has been conducted? If not, was it performed by internal teams or by a Third-Party Assessor? Yes, this is the first time this assessment will be conducted.

12. Develop the skillset to conduct threat modeling for the CUSTOMER environment. Network infrastructure that is subject to the Mitre assessment.

a. How will the representation of the “environment” be defined?

Environment will be represented through diagrams and verbal or written description of operations and infrastructure.

b. Is there a specific existing threat modeling framework in use (e.g., STRIDE, OWASP Top 10, MITRE ATT&CK, etc.) at the customer site? If so which, one is it?

SCDOR does not have a “formal” modeling at this time.

13. Provide a framework to help quantify cyber risk with regard to the cyber-attack cycle.

a. What framework beyond ATT&CK framework is expected?

None are expected, however additional framework may be proposed as value added services.

14. Strengthen security architecture resiliency to thwart efforts as adversaries continue to improve and adapt their operations over time.

a. Will be a proposal to strengthen the security architecture or implementation?

This RFP is for an assessment of our current architecture and its implementation. No new hardware or implementation services are part of this RFP.

15. Assess countermeasure and technique gaps against CUSTOMER security team skillset and resource constraints.

a. What method of skillset assessment is expected?

The “method” is to be determined by the Offeror.

16. Develop a framework and vocabulary for the CUSTOMER security team to quantify discuss and debate risk associated with current threats/attacks and future security architectural decisions.

a. Does a framework exist or is this starting from net-new?

A formal framework does not exist.

17. Develop an evaluation framework for measuring the effectiveness of security controls and SOC operations.

a. Does a framework exist or is this starting from net-new?

A formal framework does not exist.

18. Develop a dynamic framework and methodology to exercise SOC threat identification and incident response.

a. Does a framework exist or is this starting from net-new?

A formal framework does not exist.

19. Provide 8 hours of training on MITRE ATT&CK methodology and collateral, including the ATT&CK Navigator tool.

a. How many people? Approximately 20

b. Onsite? Onsite is preferred.

c. Method of training? Class room style

d. Customized or from MITRE material? Mitre ATT&CK methodology and collateral as applicable to the SCDOR assessment. The requirement for 8 hours of training is to introduce and familiarize the security team in the use of the MITRE ATT&CK framework.

Page image1.png