Annex B.pdf

NCIA/ACQ/2022/07219

Annex B

Page B-1

ANNEX B

Summary of Requirements

The Breach and Attack Simulation (BAS) is a new adversary emulation technology which enables organisations to pursue a Threat Informed Defence strategy by simulating a broad range of malicious activities, and automatically observe the reaction of the security controls in place, enabling NATO to determine if our systems can stop or detect them.

The Agency is looking for a NATO nation based solution that is comprised of one or more products integrated to provide the capability to enable cybersecurity teams to determine and fine tune cyber security posture and reduce the attack surface by emulating the latest Tactics, Techniques and Procedures used by threat actors.

RFI Instructions

You may either enter your responses under the questions on the following pages, or use a separate document to provide your responses.

Please feel free to make assumptions, however, it is important that you state what these assumptions are.

Please do not enter any general company marketing or sales material as part of your specific responses within this market survey. Please submit such material as enclosures with the appropriate references within your replies.

Please do try and answer the relevant questions as comprehensively as possible, providing as much detail as necessary.

Responses are not to exceed one (1) page for each question in no less than 12 font size.

Cost details requested in the questions refer to Rough Order of Magnitude (ROM) Procurement, not a binding offer. Please include all assumptions the estimate is based upon:

o Advantages & disadvantages of your product/solution/organisation, o Any other supporting information you may deem necessary including any assumptions relied upon.

Other supporting information and documentation (technical data sheets, marketing brochures, catalogue price lists, descriptions of existing installations, manuals, etc.) are also desired.

RFI Questions (1- 15)

1. Please provide your:

a. Company name and address

b. Point of Contact name, title and email address

2. NCIA is seeking a solution based on NATO nation products and/or services. Please indicate the name and national origin of the parent company for each product or service you are including in your survey response.

NCIA/ACQ/2022/07219

Annex B

Page B-2

Please detail all export controls on any solutions mentioned in your answers to questions 3-12 below.

3. Can your solution provides the following emulation capabilities and describe how your solution does it (please mark each applicable item):

a. Atomic testing

b. Anatomic Testing

c. PCAP replay based testing

4. Please describe how your solution provides the ability to run in production environments, in a safe manner, and at scale.

5. Please describe how the planned tests are uploaded and executed on selected assets for execution with your solution. What security mechanisms are in place in order to prevent unauthorized user to execute unauthorized tests?

6. Please describe how your solution can provide accurate detection results with clear details of what actions were performed.

7. Please describe how your solution provides high fidelity detections with integrations that provide flexibility in configuration and modification with existing security controls such as antivirus, firewalls, SIEM, NIDS.

8. Please describe how your solution can support air-gapped networks with no internet connectivity.

9. Please describe how your solution provides the ability to retrieve the security control logs for an activity that was executed earlier (1-5 days) and integrate those logs in the results of the assessment in an automatic manner.

10. Does your solution provide the ability to view the source code of any conducted test, modify it and re-execute it with the modification? Please describe.

11. Please illustrate how your solution supports the ability to run tests across all assets at the same time in parallel to provide reduced ‘time-to-results’.

12. Please illustrate how your solution provides the ability to create highly customized dashboards directly within the platform, to meet reporting requirements.

13. Please provide Rough Order of Magnitude pricing information for your solution so that the Agency has a general idea of the pricing model and potential cost.

14. Does your company provide additional support services? If so, please describe what is available and the pricing.

15. Does your company offer enterprise professional support? If so, please describe what is available and the pricing.