Amendment#4_NDR_RFP_S-10700-00010923_FINAL_12062024.pdf

Amendment #4, RFP #S-10700-00010923 Network Detection and Response (NDR) Solution Page 1 of 7

RFP: S-10700-00010923 – Network Detection and Response (NDR) Solution

AMENDMENT #4

PURPOSE

This Amendment modifies the Request for Proposal (RFP) Document identified above only to the extent indicated herein. All other areas are not changed or otherwise modified by this Amendment and remain in full force and effect. This Amendment is hereby made an integral part of the original RFP document. The purpose of this Amendment to RFP S-10700-00010923 is to set out Proposer requirements and evaluation criteria for Round 2 Evaluation. The three highest ranked Proposers as announced in the Notice of Competitive Range may participate in this Round 2 Evaluation.

MODIFICATIONS

The RFP is modified, as follows:

1. EVALUATION

RFP Section 4.15 provides in part, “At the conclusion of Round 1 evaluation, DAS PS may determine the Apparent Successful Proposer or may choose to conduct additional round(s) before the next round of competition if in the best interest of the State.”

RFP Section 4.15, is hereby amended as follows: New language is indicated by bold underlined font, deleted language is indicated by strike through font.

4.15 Round 2 Evaluation

Round 2 evalution will include the following:

A. An Online Scripted Demonstration hosted by Proposer (i.e., via MS Teams, Zoom, etc.).

Webinar hosting and all other related costs will be at Proposer’s expense. The scripted Network Detection and Response (NDR) Solution should be demonstrated in a navigable NDR Solution system environment similar to the proposed solution and not a slide or PowerPoint style of presentation with screen shots. See Sections 3 through 5 for additional information.

B. Proof of Value (POV)

Through the POV, as defined in Section 4.15.1 below, the Evaluation Committee members will log into and use the Solution to determine whether Proposer’s NDR Solution as proposed by Proposer in Round 1 Evaluation, Attachment H conforms to Proposer’s representations and whether the proposed Solution meets the requirements of Attachment H . See attached Exhibit I for scoring criterion.

C. Optional Question(s) and Answer(s) (Q&A)

During the fourth week of POV, the Evaluation Committee may elect to conduct a Q&A with each of the three highest ranked Proposers as announced in the Notice of Competitive Range. If conducted, this Q&A will be facilitated by the State of Oregon, with questions provided by the SPC via email in advance.

Amendment #4, RFP #S-10700-00010923 Network Detection and Response (NDR) Solution Page 2 of 7

D. Revised Pricing

Upon completion of the POV, for a period of 7 calendar days, The State of Oregon will accept revised pricing from Proposer if Proposer elects to submit revised pricing.

Revised Pricing must be submitted to the SPC via email within this timeframe.

Participation in the Demonstration and POV is mandatory in order to remain competitive for any Contract award under this procurement. If State elects to conduct a Q&A, participation in this Q&A is mandatory in order to remain competitive for any Contract award under this procurement.

2. RFP Section 4.15.1, Proof of Value (POV), is hereby amended as follows: New language is indicated by bold underlined font, deleted language is indicated by strike through font.

4.15.1 Proof of Value (POV)– 45 days 30 Calendar Days (Scored) As part of this round, Proposers shall provide and assist in implementation and integrations of their NDR Solution for up to 45 days 30 calendar days into the State environment. All NDR Solutions will be independently simultaneously evaluated for each of their own 45-day period a period of 30 business days. Evaluation will commence on January 6, 2025. It is the responsibility of Proposer to ensure the NDR Solution is installed and fully operational for this POV round by January 6, 2025. The State prefers having the NDR Solution installed during the week of December 16, 2024, prior to the commencement of POV (1/6/2025). Proposer shall contact SPC to make necessary arrangements. This round will be evaluated by members of the Evaluation Committee. All Proposers that enter Round 2 must participate in this Proof of Value process for their proposed NDR Solution in order to proceed through the evaluation process. If a Proposer does not participate, the Proposer’s Proposal will not be eligible for award.

3. The table provided in RFP Section 4.19, which depicts the point and score calculations, is hereby amended as follows: New language is indicated by bold underlined font, deleted language is indicated by strike through font.

Round Maximum Points Available

Round 1 Scores:

Experience and Capabilities 100

Staffing Plan, Key Persons, Organizational Chart and Subcontractors

Amendment #4, RFP #S-10700-00010923 Network Detection and Response (NDR) Solution Page 3 of 7

Proposer’s Organizational Profile 50

Scope of Services 250

Sample Implementation Plan 100

Sample SOW 100

Sample Test Plan 100

Sample Training Plan 50

Reporting Samples 50

NDR Solution Functionality - Attachment H 354

Security Requirements 100

Performance Metrics and SLAs 50

References 100

Total Score Round 1 1454

Round 2 Scores:

Demonstration (points itemized below)

Demonstration of Functionalities 100

User Interface 100

Ease of Setup/Implementation 100

Performance 500

AI Features (e.g. LLM) 100

Knowledge Base/Included Training 100

Support 150

CTI Integration 200

Multi-tenant Sentinel Integration 200

Alert Fidelity 250

Entity Identification/Categorization 200

Protocol Analysis 200

Reporting 200

Amendment #4, RFP #S-10700-00010923 Network Detection and Response (NDR) Solution Page 4 of 7

POV (see attached Exhibit I for scoring categories and criterion)

TBD 2700

Optional Q&A N/A

Revised Pricing 300

Total Score Round 2 TBD 5,400

Round 3 Scores:

Best and Final Offer Price Proposal TBD

Total Score Round 3 TBD

TOTAL POINTS 6,854

4. RFP Section 4.16 is amended to include the following:

4.16.3 DEMONSTRATIONS

4.16.3.1 DEMONSTRATION SCHEDULE:

The duration of each Demonstration will be up to (2) hours. The SPC will contact each Proposer within the Competitive Range to schedule the Demonstration.

Proposer Demonstration will be scheduled in one of the following time slots:

Demonstration 1: 12/16/2024 10:00AM – 12:00 PM PST

Demonstration 2: 12/17/2024 10:00AM – 12:00 PM PST

Demonstration 3: 12/18/2024 10:00AM – 12:00 PM PST

Participating Proposers must provide an agenda with time allocations for each topic to the SPC at least one (1) business day in advance of the scheduled Demonstration.

Participating Proposers must also submit the Demonstration connection details to the SPC via email at Brad.wisniewski@das.oregon.gov at least one (1) business day in advance of the scheduled Demonstration so Agency can test the connection.

4.16.3.2 SCRIPTED DEMONSTRATION CATEGORIES:

4.16.3.2.1 Out of 13 categories, Proposer shall demonstrate the following:

1) Demonstration of Functionalities as provided in Exhibit I

2) User Interface

3) Ease of Setup/implementation

4) Performance

Amendment #4, RFP #S-10700-00010923 Network Detection and Response (NDR) Solution Page 5 of 7

5) AI Features (e.g. LLM)

6) Knowledge base/included training

7) Support

8) CTI Integration

9) Multi-tenant Sentinel Integration

10) Alert Fidelity

11) Entity Identification/categorization

12) Protocol Analysis

13) Reporting

4.16.3.2.2 Proposer is strongly advised to adhere to each scripted category and demonstrate the required functionality in the same bulleted sequence set forth in each list. If Proposer’s Demonstration deviates from the script, the SPC will promptly ask Proposer to get back on topic and realign the demonstration with the subject Scenario sequencing.

4.16.3.2.3 The Demonstration must not include any “future” features, functionality or capabilities currently contemplated by Proposer. If a scripted Scenario requires Proposer to demonstrate a feature, function or capability that was not included in Proposer’s proposal and is not currently available in Proposer’s NDR Solution, Proposer should state “this feature/function/capability is currently not available” and then proceed to the next required demonstrated function.

4.16.3.2.4 The Demonstration should not include extensive artwork, unusual printing or other materials not essential to the utility and clarity of the scripted category. Do not include marketing or advertising material in the Demonstration. Demonstration should be straightforward and address the requests of the scripted categories. Demonstrations containing excess marketing or advertising material may receive a lower evaluation score if specific information is difficult to locate.

4.16.4 Evaluation Criteria

4.16.4.1 Demonstration of Functionalities (Scored)

Degree to which Proposer demonstrated or explained the functionalities from the Functionalities Requirements Document. Degree to which Proposer provided thorough demonstration of each functionality. Was it easy to follow along? (e.g. did Proposer go down the list or was it random-all-over-the-place?)

4.16.4.2 User Interface (Scored)

User Interface will be scored on usability, aesthetics, responsiveness, and functionality.

1. Usability: Degree of intuitiveness for User Interface, ease of navigation and user-friendliness.

2. Aesthetics: Is the NDR Solution consistent in design elements like fonts, colors, and icons?

Does the UI stay the same?

3. Responsiveness: Does the UI load quickly and adapt to different screen sizes or devices?

4. Functionality: Are the interface elements, such as buttons and menus, functional and free of bugs?

4.16.4.3 Setup/Implementation (Scored)

Amendment #4, RFP #S-10700-00010923 Network Detection and Response (NDR) Solution Page 6 of 7

NDR Solution ease of deployment, configuration, and management (e.g. how ‘plug-and-play’ is it?). NDR Solution compatibility with the State's on-premises and cloud networks. Extent of command inputs to perform optimally. Ability for the NDR Solution to support mirror porting.

4.16.4.4 Performance (Scored)

In terms of Performance, NDR Solution will be evaluated on responsiveness to queries, ability for hardware to handle the throughput of the data volume, and the scalability in the NDR the Solution to handle the increasing volume of network traffic in the state's large and growing networks, without compromising performance.

4.16.4.5 Knowledgebase/Included Training (Scored)

Extent of Solution Provider’s website in providing ample Knowledge Base information and included training at no additional cost. Extent of informative detail on Solution Provider’s website (Does the website have longform or quick vignettes of information?).

4.16.4.6 Functionality Scoring (Scored)

See attached Exhibit I, Functionality Scoring, for POV evaluation criterion.

4.16.4.7 Support (Scored)

Extent and responsiveness of Solution Provider’s support in troubleshooting issues, incident response notification timelines, technical assistance.

4.16.4.8 CTI (Computer Telephony Integration) (Scored)

Ability for CTI from NDR Solution to be integrated bi-laterally with the Recorded Future CTI platform. Ability for the NDR Solution to integrate with threat intelligence feeds to enhance the detection capabilities by leveraging up-to-date information on known threats.

4.16.4.9 Multi-tenant Sentinel Integration (Scored)

Ability for the NDR Solution to identify traffic specific to individual agencies and forward only that information to the relevant Tenant/Sentinel.

Extent the NDR Solution is able to separate traffic for integration with 8 separate SIEMs (Security Information and Event Management): Does the NDR Solution have seamless integration with 8 instances of Microsoft Sentinel, to provide a comprehensive view of security events across the organization.

4.16.4.10 Alert Fidelity (Scored)

Can the NDR Solution be tuned? If so, to what extent? What are the nature of the alerts? How many alerts are generated in a given hour? Does the NDR Solution have the ability for alert aggregation into logical security incidents based on multiple factors (not only alert ID and repeated alerts)?

Ability of NDR Solution to have the capability to be tuned to minimize false positives - to ensure that security teams can focus on genuine threats without being overwhelmed by irrelevant alerts.

Does the NDR Solution help minimize false positives (e.g. filter, prioritize or identify matches, to improve triage and analysis)?

4.16.4.11 Entity Identification/Categorization (Scored)

Extent of NDR Solution’s ability to categorize or identify assets or users (e.g. can it pull device name/username/application? Can it identify above layer 3 or layer 4?). In addition to layer 3 & 4

Amendment #4, RFP #S-10700-00010923 Network Detection and Response (NDR) Solution Page 7 of 7 detection and monitoring, does the NDR Solution also monitor layer 7 traffic? If so, to what extent? Is the NDR Solution capable of asset grouping and management? If so, to what extent?

4.16.4.12 Protocol Analysis (Scored)

How many protocols does the NDR Solution identify? Does the NDR Solution provide non-standard protocol analysis? Ability for the NDR Solution to support the analysis of various network protocols to detect anomalies and malicious behavior across different communication channels.

4.16.4.13 Reporting (Scored)

How well does the NDR Solution produce reports? Is there the ability to customize reporting? If so, to what extent? Ease of use to export data or reports? Are all the data elements available for reporting?

PROTEST

Protests to this RFP Amendment must be submitted in the manner required in RFP Section 4.5.2 and are due by Wednesday, December 11, 2024, at 5:00 PM Pacific Time.

Single Point of Contact (SPC): Brad Wisniewski, State Procurement Analyst Brad.wisniewski@das.oregon.gov

(971) 707-1672 mailto:Brad.wisniewski@das.oregon.gov