Attachment_A-_Managed_Security_Services_RFI_Workbook.xlsx
XLSX spreadsheet 57 KB Posted
- Attached to
- CALNET Managed Security Services RFI
- Solicitation number
- 0000032685
- Issued by
- California
About this file
This document is a Request for Information (RFI) issued by the California Department of Technology's CALNET Program. The RFI seeks information from the vendor community on cybersecurity solutions and services that align with the five phases and initiatives outlined in the State of California Cyber Security Strategic Plan (Cal-Secure). The goal is to collect detailed information about security service offerings to develop requirements for future statewide managed security service contracting opportunities. The RFI covers a wide range of security capabilities, including anti-malware protection, anti-phishing, multi-factor authentication, vulnerability management, asset management, incident response, patch management, privileged access management, security awareness training, security monitoring, cloud security, threat intelligence, application security, log management, network threat detection, operational technology security, disaster recovery, identity lifecycle management, insider threat detection, network access control, enterprise encryption, mobile threat defense, and more.
The RFI does not include any information about pricing, set-asides, incumbents, funding requirements, or other financial details. It is solely focused on gathering technical and administrative information from vendors to inform future procurement efforts. The RFI also outlines the administrative requirements, such as the ability to provide a live data feed to the State's Office of Information Security, online portals, billing and invoicing capabilities, reporting, and oversight requirements.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| CALNET_Managed_Security_Services_RFI.docx | DOCX document | |
| Attachment_B-_Cal-Secure_Cybersecurity_Strategic_Plan.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions
REQUEST FOR INFORMATION
MANAGED SECURITY SERVICES
| State of California |
| California Department of Technology |
Office of Statewide Technology Procurement
California Network and Telecommunications (CALNET) Program
The California Department of Technology CALNET Program is requesting information on cybersecurity solutions and services that align with the five phases and initiatives outlined in the State of California Cyber Security Strategic Plan (Cal-Secure).
The link to the Cal-Secure plan is located at this website address:
https://cdt.ca.gov/wp-content/uploads/2021/10/Cybersecurity_Strategy_Plan_FINAL.pdf
The goal of this RFI is to collect detailed information from the vendor community around security service offerings. The data collected is intended to be used in developing requirements for future statewide managed security service contracting opportunities. This is not a solicitation.
Please review the different tabs within this Workbook, and provide as much detailed information as possilbe. The State is not looking for traditional "Marketing Material". The State is looking for details that may be used to develop technical and administrative requirements for future bidding efforts.
If your solution does not meet or offer a capability listed in the "Capabilities, Features, and/or Specifications" column, please indicate "N/A" in the "Description of Service Offering" column. If the capability is offered, please provide a detailed explanation. The "Additional Info" column is available for any supplementary related information you may wish to include.
Please feel free to provide additional documentation with your response via email to the Office of Statewide Technology Procurement (OSTP) officer listed on the Cal eProcure website.
Please Provide the Following Information:
| Vedor Name: | ||
| Vendor Contact: | ||
| Phone Number: | ||
| Email Address: | ||
| Can we contact you for additional information? | ||
| OSTP Contact: | Amrit Dhillon | amrit.dhillon@state.ca.gov |
| Phone # | (916) 595-4259 |
mailto:amrit.dhillon@state.ca.gov Phase 1
| Capabilities, Features and/or Specifications | Description of Service Offering | Additional Info |
| Anti-Malware Protection | ||
| What features does the solution offer for detecting and preventing various types of malware (viruses, ransomware, spyware, etc.)? | ||
| Does the solution provide real-time protection and on-demand scanning? (Describe) | ||
| Is there centralized management? Is it cloud hosted or hosted by the customer? What data is available on the dashboards? | ||
| What is the solution’s performance impact on system resources? | ||
| Does the solution offer incident response and remediation capabilities? (Explain) | ||
| Can the solution be deployed across various platforms and devices (Windows, macOS, Linux, mobile devices)? | ||
| Does the solution include features for advanced threat protection, such as sandboxing or endpoint detection and response (EDR)? | ||
| How frequently are malware definitions and software updates provided? | ||
| How does the solution handle false positives and false negatives? | ||
| What detection techniques does the solution use (signature-based, heuristic, behavioral analysis, machine learning)? | ||
| How quickly does the software respond to emerging threats? How does it respond? | ||
| Does the solution integrate with other security tools and systems and what methods does it use to do so? | ||
| What data is available on the dashboards? | ||
| Are there customizable reports? | ||
| How does the solution handle mobile device protection, especially for BYOD policies? | ||
| Anti-Phishing Program | ||
| Do you provide email scanning services? | ||
| Do you provide Anti-Virus Protection? | ||
| Do you provide Spam Filtering? | ||
| How do you protect against malware (viruses, worms, ransomware and Trojan horses)? | ||
| Do you provide policy enforcement? | ||
| How do you allow for customer administration of content controls? | ||
| Do you provide a remote scrubbing facility to address affected data? | ||
| What is your notification process for this service? | ||
| Do you provide for disaster recovery options for customer email? | ||
| Do you offer quarantine options associated with the scanning services? Explain the capabilities, e.g. auto-quarantine, incident response workflows... | ||
| Are your email and scanning services network provider specific, or vendor agnostic? | ||
| What types of reports and analytics does the solution provide? Are they customizable, and do they support compliance audits? | ||
| Do you offer tools for running phishing simulations and training users? | ||
| Multi-Factor Authentication | ||
| What does the MFA solution integrate with? APIs? | ||
| What is the user enrollment and onboarding process? | ||
| Is there centralized management? Cloud hosted? Self hosted? | ||
| What failover mechanisms are available? | ||
| What data is logged? | ||
| How do you mange users, monitor authentication attempts, and generate reports? | ||
| Can administrators track and review authentication attempts and security events? | ||
| Are triggered events/alerts available? What types of alerts are available? | ||
| What types of MFA methods do you support (e.g., SMS, email, push notification, biometrics, etc.) | ||
| Are automated actions based on alerts available? | ||
| Continuous Vulnerability Management | ||
| Do you provide vulnerability management services to your clients? | ||
| Do you provide, at no additional cost, managed vulnerability result validation for compliance as part of your vulnerability management services? | ||
| Do you integrate with third-party vulnerability scanning services? | ||
| Do you provide asset management to ensure that no unauthorized devices are accessing the customer network? | ||
| Do you provide tiered services, on demand or unlimited options? | ||
| Do you provide assessments for wireless access point (WAP) detection? | ||
| Are your vulnerability management services network specific, or agnostic? | ||
| Do you have the service capabilities to monitor vulnerability scans internally and externally with the organization. | ||
| How are vulnerabilities triaged and prioritized prior to reporting, including the integration of previous scan results and actions carried out? | ||
| How frequently is your vulnerability database updated, and what are the data sources used for that? | ||
| Do you provide application-specific scanning abilities? |
Phase 2
| Capabilities, Features and/or Specifications | Description of Service Offering | Additional Info |
| Asset Management | ||
| What types of assets does the software support? | ||
| Does the software provide lifecycle management for hardware, software, and other assets? | ||
| Can the software track both physical and virtual assets? What kind of compatibility does it have with assets, for example, if MacOS supported, how many versions back are supported (e.g., current version minus 3)? Which versions of Windows, is supported (e.g., Windows 7, 10,11, Windows Server 2008, 2012, 2019, 2022, etc.)? | ||
| How does the software handle asset depreciation and value tracking? | ||
| Does the software support inventory management and auditing? | ||
| What APIs and integration options are available? | ||
| Are there customizable dashboards and reporting tools? | ||
| How does the software ensure the security of asset data? | ||
| Are there user access controls and permission settings? | ||
| Does the software provide audit trails and logging capabilities? | ||
| Are there any limits on the number of assets or users? | ||
| Incident Response | ||
| What integrations are available? | ||
| How does the solution detect incidents? What types of alerts does it provide? | ||
| What automated response capabilities does the solution offer? Can it isolate infected systems automatically? | ||
| How easy is it to manually intervene and respond to incidents using the solution? | ||
| What forensic analysis tools are included? Can it capture and analyze data for a detailed post-incident review? | ||
| Does the solution provide predefined playbooks and workflows for common incidents? Can these be customized? | ||
| What kind of documentation and training materials are provided? | ||
| What support options are available (e.g., 24/7 support, dedicated account manager)? | ||
| How quickly does the solution detect and respond to incidents? | ||
| How reliable is the solution? What are the uptime guarantees? | ||
| Does the solution impact system performance? If so, how significantly? | ||
| Does the solution help meet industry-specific compliance requirements (e.g., NIST, HIPPA, PCI-DSS, etc.)? | ||
| What reporting capabilities does the solution offer? Can it generate customizable reports for different stakeholders? | ||
| How does the solution manage the entire lifecycle of an incident, from detection to resolution and post-incident analysis? | ||
| Does the solution facilitate collaboration among IT and security teams during an incident? | ||
| How does the solution ensure the security of incident data? Is the data encrypted both in transit and at rest? | ||
| What access control mechanisms are in place to ensure only authorized personnel can access incident response tools and data? | ||
| Continuous Patch Management | ||
| Does the solution integrate with other IT infrastructure? | ||
| Can it work across different operating systems and devices? | ||
| How automated is the patch management process? | ||
| Does the solution support automated patch testing, deployment, and rollback? | ||
| Does the solution help us stay compliant with industry standards and regulations? | ||
| Can it generate compliance reports for audits? | ||
| How does the solution prioritize and address security vulnerabilities? | ||
| Does it provide real-time monitoring and alerts for patch-related issues? | ||
| Does it allow for scheduled and managed patches? | ||
| What types of reports can the solution generate? | ||
| Are there customizable reporting options to meet our specific needs? | ||
| How well does it handle large and distributed environments? | ||
| What level of customer support does the vendor provide? | ||
| Are there training and resources available to help our team get up to speed? | ||
| Does it offer features to minimize downtime and disruption to business operations? | ||
| Where does the solution source its patches from? | ||
| How quickly are new patches made available after release? | ||
| Can we create and enforce custom patch management policies? | ||
| How flexible are the policy settings for different user groups and device types? | ||
| How does the solution assess and manage the risk of deploying patches? | ||
| Does it provide a rollback feature in case of patch failure? | ||
| Is the solution available as an on-premises, cloud-based, or hybrid option? | ||
| How easy is it to switch deployment options if needed? | ||
| Does the solution integrate with security tools (e.g., antivirus, endpoint protection)? | ||
| Can the solution easily work in conjunction with industry leading Security Information and Event Management (SIEM) systems? If so, which ones? | ||
| Privileged Access Management | ||
| How does the solution manage and control privileged access? | ||
| What authentication methods are supported (e.g., multi-factor authentication)? | ||
| How does the solution handle privileged session monitoring and recording? | ||
| How does the solution enforce the principle of least privilege? Zero Trust? | ||
| How are privileged credentials stored, rotated, and managed? | ||
| Is the solution compatible with existing systems, applications, and infrastructure? | ||
| Does the solution provide APIs for custom integrations? | ||
| Does the solution help meet regulatory and compliance requirements (e.g., NIST, CCPA, HIPPA, PCI-DSS, NIST, etc.)? | ||
| Does the solution provide detailed audit logs and reports for privileged access activities? | ||
| How comprehensive are the reporting capabilities? Can reports be customized? | ||
| How are users and roles managed within the solution? | ||
| Does the solution support role-based access control (RBAC) and how granular is the control? | ||
| How does the solution perform under load? Are there any known performance issues? | ||
| What deployment options are available (e.g., on-premises, cloud, hybrid)? | ||
| What support options are available (e.g., 24/7 support, dedicated account manager)? | ||
| How frequently does the vendor release updates and security patches? | ||
| How does the solution help identify and mitigate risks associated with privileged access? | ||
| What capabilities does the solution offer for incident detection and response? | ||
| What training and resources are available for administrators and users? | ||
| Security and Privacy Awareness Training | ||
| What topics are covered in the training program (e.g., phishing, password security, data privacy, social engineering)? | ||
| How frequently is the content updated to reflect the latest threats and best practices? | ||
| Does the training include modules specific to privacy regulations (e.g., CCPA, HIPPA, PCI-DSS, NIST, etc.)? | ||
| Is the training customizable to address specific needs and policies of the organization? | ||
| What types of training formats are available (e.g., online courses, in-person workshops, interactive simulations)? | ||
| Are there engaging and interactive elements to maintain user interest? | ||
| How does the solution assess user comprehension and retention (e.g., quizzes, tests)? | ||
| Is there ongoing reinforcement training to ensure continuous awareness? | ||
| Does the training include real-world scenarios and case studies? | ||
| Are there mechanisms to track and report user progress and completion? | ||
| How easy is it to integrate the training solution with existing systems (e.g., Learning Management Systems)? | ||
| Are there options for tailoring the training for different user groups or departments? | ||
| What languages are supported by the training materials? | ||
| How does the solution handle accessibility? | ||
| Is there technical support available for users who encounter issues during training? | ||
| What are the vendor’s credentials and experience in providing security and privacy training? | ||
| Are there options for conducting phishing simulations and other practical exercises? | ||
| How does the training address the human factor in security, emphasizing behavior change? | ||
| How does the solution ensure compliance with industry standards and regulations? | ||
| Are there any additional resources provided (e.g., newsletters, webinars, whitepapers)? | ||
| What feedback mechanisms are in place to continually improve the training content? | ||
| Security Continuous Monitoring 24x7 | ||
| What types of threats and vulnerabilities can the solution detect? | ||
| What are the key features of the solution (e.g., real-time monitoring, threat intelligence, incident response)? | ||
| Does the solution support integration with other tools? | ||
| How frequently are the threat intelligence feeds updated? | ||
| What are the solution’s capabilities for automated threat detection and response? | ||
| Can the solution provide comprehensive coverage across all endpoints, networks, and cloud environments? | ||
| What level of customization is available for dashboards and reporting? | ||
| What training and support resources are available to help our team use the solution effectively? | ||
| Does the solution provide built-in compliance reporting for standards (e.g., NIST, HIPPA, PCI-DSS, etc.)? | ||
| Can the solution generate detailed audit logs and reports for regulatory purposes? | ||
| How does the solution handle data privacy and security, especially regarding sensitive information? | ||
| What are the solution’s performance benchmarks (e.g., detection speed, false positive rate)? | ||
| How does the solution minimize the impact on system performance and network bandwidth? | ||
| What level of customer support is provided (e.g., 24/7 support, dedicated account manager)? | ||
| Is post-breach monitoring available (e.g., log analysis, living-off-the-land attacks, etc.)? |
IF YES,
- What is the lifecycle of an analytic rule?
- What framework/roadmap (for example MITRE), is used to create analytic rules?
- How are analytic rules created, tested, deployed?
- How are analytic rules tuned for false positives?
IF NO,
- Does the tool come with pre-built analytic rules that can be deployed?
- How are those pre-built analytic rules deployed, tuned, tested, etc.?
- Is there a roadmap to add more pre-built analytic rules that come with the tool?
| Cloud Security Monitoring |
| What cloud platforms (AWS, Azure, Google Cloud, etc.) does the solution work with? |
| Can it integrate with other security tools and systems? |
| How does the solution handle scaling with the growth of cloud infrastructure? |
| Are there any limitations on the number of cloud assets it can monitor? |
| What types of threats can the solution detect (malware, unauthorized access, DDoS attacks, etc.)? |
| How frequently are threat intelligence updates provided? |
| Does the solution provide automated incident response capabilities? |
| Does the solution help us comply with relevant regulations (GDPR, HIPAA, etc.)? |
| Are there built-in compliance reporting and auditing features? |
| What kind of monitoring capabilities does the solution offer (real-time, historical analysis, etc.)? |
| How customizable are the reports and dashboards? |
| How are alerts generated and delivered (email, SMS, integration with other alerting systems)? |
| Can alert thresholds and criteria be customized? |
| Does the monitoring solution impact the performance of our cloud services? |
| How does it handle large-scale data collection and analysis? |
| What support options are available (24/7 support, dedicated account manager, etc.)? |
| Is there a comprehensive knowledge base or community support? |
| How frequently are updates and patches released? |
| What is the process for applying updates and patches? |
| Does the solution utilize machine learning or AI for threat detection and analysis? |
| How effective are these features in identifying and mitigating threats? |
| Does the solution offer User and Entity Behavior Analytics (UEBA) capabilities? |
| How does it analyze and respond to anomalous behavior? |
| Are there features specifically designed for cloud environments (e.g., container security, serverless security)? |
| How does the solution handle multi-cloud environments? |
| How does the vendor plan to stay ahead of emerging cloud security threats? |
| Does the vendor do regular penetration tests against its platform? |
Phase 3
| Capabilities, Features and/or Specifications | Description of Service Offering | Additional Info |
| Threat Intelligence Platform | ||
| How well does the platform integrate with other security tools and systems (e.g., SIEM, EDR, firewalls)? | ||
| Are there pre-built integrations or APIs available for seamless data sharing? | ||
| Does the platform support automation and orchestration of threat intelligence workflows? | ||
| What reporting features exist within your services to capture threat intelligence? | ||
| Does your security research team develop threat reports? If so, how often? | ||
| Do you provide penetration testing services? | ||
| Do you have advanced threat detection capabilities? | ||
| Describe how you detect threats. Do you use signatures, behavioral analysis, anomaly detection, volume analysis or malicious host detection? | ||
| Do you perform signature tuning and maintenance? | ||
| Do you provide website application assessments? | ||
| How can you support audit/compliance requirements? | ||
| Do you provide Endpoint Managed Detection and Response service offering? | ||
| Does the platform use machine learning or artificial intelligence to enhance threat detection and analysis? | ||
| What sources of threat intelligence data does the platform use (e.g., open-source, commercial, proprietary feeds)? | ||
| What feedback reporting features exist within your services to capture threat intelligence? | ||
| How does the platform ensure the security and confidentiality of the data it processes? | ||
| Are your threat intelligence services network provider specific, or vendor agnostic? | ||
| Application Security | ||
| What does the solution integrate with? | ||
| Does the solution provide real-time vulnerability detection during the development process? | ||
| How effective is the solution in identifying a wide range of vulnerabilities (OWASP Top 10, SANS/CWE Top 25, zero-day vulnerabilities, etc.)? | ||
| Does the solution offer static, dynamic, and interactive application security testing (SAST, DAST, IAST)? | ||
| Are there any limitations on the size or complexity of the applications it can scan? | ||
| How frequently are vulnerability definitions and threat intelligence updates provided? | ||
| Does the solution offer automated remediation suggestions or integration with ticketing systems for tracking and resolving vulnerabilities? | ||
| How does the solution support secure coding practices and developer education? | ||
| Are there built-in training modules or resources for developers? | ||
| Does the solution help us comply with relevant regulations and standards (NIST, HIPAA, PCI-DSS, etc.)? | ||
| Are there built-in compliance reporting and auditing features? | ||
| How customizable are the security policies and rules? | ||
| Can we tailor the solution to meet our specific security requirements? | ||
| What kind of monitoring capabilities does the solution offer (real-time, historical analysis, etc.)? | ||
| How customizable are the reports and dashboards? | ||
| How are alerts generated and delivered (email, SMS, integration with other alerting systems)? | ||
| Can alert thresholds and criteria be customized? | ||
| Does the solution impact the performance of our applications during scanning? | ||
| How does it handle large-scale application portfolios? | ||
| What support options are available (24/7 support, dedicated account manager, etc.)? | ||
| Is there a comprehensive knowledge base or community support? | ||
| How frequently are updates and patches released? | ||
| What is the process for applying updates and patches? | ||
| Does the solution utilize machine learning or AI for threat detection and analysis? | ||
| How effective are these features in identifying and mitigating threats? | ||
| Does the solution offer features specifically designed for web, mobile, and cloud applications? | ||
| How does the solution handle multi-cloud and hybrid environments? | ||
| Log Management | ||
| What types of logs and data sources does the solution support? | ||
| How easy is it to integrate with existing systems and applications? | ||
| Does the solution support real-time data collection and processing? | ||
| How does the solution scale to handle large volumes of logs? | ||
| How does the solution perform under high load conditions? | ||
| Are there any limitations on the amount of data that can be stored or processed? | ||
| What are the data retention policies and capabilities of the solution? |
- Can different log types have different retention periods?
- Does the solution allow for different logging profiles?
- Can the tool log in Comment Event Format?
- Can endpoint logging be customized to log only security events and not every event?
- Can stored data be queried or would it have to be re-ingested / retrieved before querying (some tools have a separate query tool that can search archived data)?
| How is the log data stored, and can it be easily archived or retrieved? |
| How robust are the search and query capabilities? |
| Does the solution offer advanced analytics, such as machine learning or anomaly detection? |
| Can it provide real-time insights and alerts based on log data? |
| How does the solution ensure the security and integrity of log data? |
| Does it comply with relevant industry standards and regulations (e.g., NIST, CCPA, HIPPA, PCI-DSS, etc.)? |
| Are there built-in features for auditing and reporting? |
| Are there customizable dashboards and reporting tools available? |
| Does the solution support automation for log collection, processing, and response? |
| How well does it integrate with other security tools and platforms (e.g., SIEM, SOAR)? |
| Are there APIs available for custom integrations and workflows? |
| What types of alerts and notifications can be configured? |
| Can alerts be customized based on specific criteria or thresholds? |
| Does the solution support integration with communication tools (e.g., email, SMS, Slack)? |
| What level of customer support is available (e.g., 24/7, dedicated account manager)? |
| Is there a comprehensive knowledge base or community support forum? |
| What are the policies and procedures for updates, patches, and maintenance? |
| Network Threat Detection |
| How effective is the solution in detecting a wide range of network threats (e.g., malware, phishing, DDoS attacks)? |
| Does the solution use advanced detection techniques such as machine learning, behavioral analysis, and signature-based detection? |
| Can it detect both known and unknown threats (zero-day attacks)? |
| How easily does the solution integrate with existing security infrastructure and tools (e.g., SIEM, firewalls, endpoint protection)? |
| Does it support integration with cloud environments and hybrid infrastructures? |
| Can the solution scale to meet the needs of a growing network with increasing traffic and data? |
| What is the performance impact on network speed and latency? |
| Does the solution offer real-time monitoring and alerting capabilities? |
| How quickly can it respond to detected threats, and what automated response options are available? |
| What kind of reporting and visualization tools are provided for analyzing threats and generating compliance reports? |
| Does the solution incorporate threat intelligence feeds to stay updated on the latest threats? |
| Can it share threat intelligence with other systems and collaborate with threat-sharing communities? |
| How effective is the solution in minimizing false positives? |
| What tuning and customization options are available to adjust detection rules and thresholds? |
| Does the solution help meet regulatory compliance requirements (e.g., NIST, CCPA, HIPPA, PCI-DSS, etc.)? |
| Are there built-in features to facilitate audit and compliance reporting? |
| What kind of support and training does the vendor provide? |
| Are there options for creating custom detection rules and scripts? |
| Does the solution provide tools for incident response and forensic analysis? |
| How comprehensive are the logs and data retention policies for post-incident investigation? |
| What is the impact on network performance and user experience? |
| How does the solution handle high-volume traffic and peak usage times? |
- What is the tools event per second threshold?
- What happens if the Events Per Second (EPS) is exceeded (for example, do packets bypass inspection)?
- Does the tool allow for stateful and stateless configurations?
| What deployment options are available (on-premises, cloud-based, hybrid)? |
| Operational Technology Security |
| Does the solution comply with relevant industry standards and regulations (e.g., NIST, IEC 62443, NERC CIP)? |
| How does the solution support audit and compliance reporting? |
| How does the solution detect and respond to known and unknown threats in real-time? |
| Does it use behavioral analysis, anomaly detection, or signature-based detection? |
| Can the solution automatically discover and inventory all OT (Operational Technology) assets? |
| How often is the asset inventory updated? |
| How does the solution support network segmentation and micro-segmentation? |
| What capabilities does it offer for monitoring network traffic and detecting unauthorized access? |
| How does the solution identify, patch and manage vulnerabilities in OT systems and devices? |
| Does it integrate with existing vulnerability management systems? |
| Can the OT security solution integrate with existing IT security tools (e.g., SIEM, IDS/IPS, firewalls)? |
| Does it provide a unified view of IT and OT security? |
| What incident response capabilities does the solution offer? |
| Does it provide forensic tools to analyze and investigate incidents? |
| How easy is it to deploy and configure the solution in an existing OT environment? |
| Can the solution scale to cover all OT assets across multiple sites or geographic locations? |
| What are the performance impacts on the network and devices? |
| What level of support does the vendor offer (e.g., 24/7 support, dedicated account managers)? |
| Does the solution incorporate threat intelligence feeds specific to OT environments? |
| How frequently is the threat intelligence updated? |
| How does the solution manage and enforce access control policies for OT systems? |
| Does it support multi-factor authentication and role-based access control? |
| How does the solution ensure the integrity and confidentiality of data within the OT environment? |
| Are there mechanisms in place to protect sensitive information from being compromised? |
| How does the solution support business continuity and resilience in case of a security incident? |
| What are the failover and recovery capabilities? |
Phase 4
| Capabilities, Features and/or Specifications | Description of Service Offering | Additional Info |
| Disaster Recovery | ||
| What types of disasters does the solution cover (natural disasters, cyber-attacks, human error, etc.)? | ||
| How does the solution ensure data integrity and consistency during recovery? | ||
| What are the Recovery Point Objective (RPO) and Recovery Time Objective (RTO) the solution can achieve? | ||
| How frequently can backups be performed, and what are the options for scheduling them? | ||
| What data replication options are available (synchronous, asynchronous, etc.)? | ||
| Does the solution support both on-premises and cloud environments? | ||
| How does the solution handle failover and failback processes? | ||
| What security measures are in place to protect data during backup and recovery? | ||
| Does the solution comply with industry-specific regulations and standards (e.g., NIST, CCPA, HIPAA, PCI-DSS, etc.)? | ||
| How does the solution ensure the confidentiality, integrity, and availability of data? | ||
| How easy is it to test the DR plan regularly, and what testing options are available? | ||
| Can we perform non-disruptive testing to ensure the DR plan works without affecting operations? | ||
| What reporting and auditing features are provided to track the effectiveness of the DR solution? | ||
| What level of support does the vendor offer (24/7 support, dedicated account managers, etc.)? | ||
| How are software updates and patches handled? | ||
| What is the vendor's response time in case of an issue or disaster? | ||
| How well does the solution integrate with existing IT service management (ITSM) tools? | ||
| Can the solution be customized to meet specific business needs and workflows? | ||
| What APIs or connectors are available for integration with other systems? | ||
| How user-friendly is the solution's interface and management console? | ||
| What training and documentation are provided to ensure our team can effectively use the solution? | ||
| Enterprise Sign-On | ||
| What authentication methods are supported (e.g., multi-factor authentication, biometrics, smart cards)? | ||
| What encryption standards does the solution use to protect credentials and data in transit? | ||
| Does the solution comply with relevant security and privacy regulations (e.g., CCPA, HIPAA, PCI-DSS, etc.)? | ||
| How does the solution manage and enforce access controls and permissions? | ||
| Which applications and services (both on-premises and cloud-based) does the solution integrate with? | ||
| Does the solution integrate with existing directory services like Active Directory or LDAP? | ||
| Are there APIs available for custom integrations and automation? | ||
| Does the solution provide true SSO across all platforms and devices? | ||
| Does the solution include features for password management and self-service password reset? | ||
| What uptime guarantees or SLAs does the solution offer? | ||
| How does the solution impact login times and overall system performance? | ||
| Does the solution provide a centralized management console for administrators? | ||
| What reporting and analytics features are available for monitoring access and usage? | ||
| How does the solution handle policy management for different user groups and applications? | ||
| What levels of customer support are available (e.g., 24/7 support, dedicated account manager)? | ||
| Are there training programs and comprehensive documentation available for administrators and users? | ||
| What deployment options are available (e.g., on-premises, cloud-based, hybrid)? | ||
| Mobile Device Management | ||
| What security protocols and encryption standards does the MDM solution support? | ||
| Does the solution offer robust data loss prevention (DLP) capabilities? | ||
| How does the MDM handle device and data encryption? | ||
| Are there mechanisms for secure VPN access and mobile threat defense? | ||
| What are the capabilities for remote wipe, lock, and locate features? | ||
| How does the solution handle authentication and identity management? | ||
| What types of devices and operating systems are supported (iOS, Android, Windows, etc.)? | ||
| Can the MDM manage both corporate-owned and BYOD (Bring Your Own Device) policies? | ||
| Does the solution support app management, including app wrapping, containerization, and app store integration? | ||
| How are software updates and patches managed across devices? | ||
| What is the process for enrolling and de-enrolling devices? | ||
| Is there a self-service portal for users to manage their own devices? | ||
| How does the MDM affect device performance and battery life? | ||
| How well does the MDM integrate with existing IT infrastructure and enterprise applications? | ||
| Does the solution support integration with other security tools, such as SIEM or IAM systems? | ||
| Is there API support for custom integrations? | ||
| Does the MDM help meet regulatory compliance requirements (e.g., NIST, CCPA, HIPAA, CI-DSS, etc.)? | ||
| What types of reporting and analytics capabilities are available? | ||
| Can the MDM provide real-time monitoring and alerts? | ||
| How scalable is the MDM solution to accommodate future growth? | ||
| What is the performance impact on the network and devices? | ||
| What are the support options (24/7, phone, email, chat)? | ||
| What are the service level agreements (SLAs) for uptime and issue resolution? | ||
| What is the pricing model (per device, per user, subscription-based)? | ||
| Application Development Security | ||
| How well does the solution integrate with existing development and CI/CD tools (e.g., Git, Jenkins, Docker)? | ||
| Does it support integration with popular IDEs and development environments? | ||
| What types of applications and languages does the solution support? | ||
| Does it cover both web and mobile applications? | ||
| How frequently are new languages and frameworks added to the support list? | ||
| What types of vulnerabilities can the solution detect (e.g., SQL injection, XSS, insecure deserialization)? | ||
| How effective is the detection rate? | ||
| Does it provide real-time scanning and feedback? | ||
| Does the solution offer actionable remediation guidance for detected vulnerabilities? | ||
| Are there features to help prioritize vulnerabilities based on risk and impact? | ||
| Does the solution help ensure compliance with relevant industry standards and regulations (e.g., OWASP, NIST, CCPA, HIPPA, PCI-DSS, etc.)? | ||
| Are there built-in compliance reporting features? | ||
| How does the solution handle user roles and permissions? | ||
| Are there features for secure access control and audit logging? | ||
| Can the solution scale with the growth of your applications and user base? | ||
| What is the impact on application performance during scanning? | ||
| Is there comprehensive documentation and support available? | ||
| Does the solution support automated security testing as part of the development lifecycle? | ||
| Are there capabilities for dynamic and static analysis? | ||
| How well does the solution integrate with DevSecOps practices? | ||
| Does it support automated security gates in the CI/CD pipeline? | ||
| What incident response features are included (e.g., alerts, notifications)? | ||
| How does it facilitate collaboration between development and security teams during incident resolution? | ||
| What level of customer support is provided (e.g., 24/7 support, dedicated account manager)? | ||
| Are there training and onboarding services available? | ||
| How customizable is the solution to fit specific security policies and workflows? | ||
| Can custom rules and checks be created? | ||
| What reporting capabilities are available? | ||
| Does it provide detailed analytics and dashboards for tracking security metrics over time? | ||
| Is there an active community or ecosystem for sharing best practices and custom rules? | ||
| Does the vendor provide regular updates and enhancements based on community feedback? | ||
| Application Whitelisting | ||
| What operating systems is the solution compatible with? | ||
| What is the impact on system performance, and does it introduce any latency or slow down processes? | ||
| Does the solution provide automated application approval processes, and how effective are they? | ||
| How are whitelisting policies created, managed, and enforced? Is there a centralized management console? | ||
| Does the solution offer granular control over which applications are allowed or blocked, based on various criteria (e.g., user roles, file hashes, digital signatures)? | ||
| Does the solution provide real-time monitoring and alerting of unauthorized application attempts? | ||
| Does the solution incorporate threat intelligence to identify and respond to emerging threats? | ||
| What capabilities does the solution offer for incident response and remediation in the event of a breach or unauthorized application execution? | ||
| Are there comprehensive auditing and reporting features that provide visibility into application usage and policy enforcement? | ||
| What training resources and support options are available for IT staff to effectively manage the solution? | ||
| Can policies be easily updated and adjusted to accommodate changes in the application landscape or organizational needs? | ||
| Does the solution help meet regulatory and compliance requirements relevant to the organization (e.g., NIST, CCPA, HIPAA, PCI-DSS, etc.)? | ||
| How does the solution handle and protect sensitive data, especially during the whitelisting and approval processes? | ||
| Software Supply Chain Management | ||
| Does the solution integrate seamlessly with existing ERP, CRM, and other enterprise systems? How well does it integrate with current software development and CI/CD tools? | ||
| Does the solution provide APIs for custom integrations? How flexible is the solution in terms of customization to meet our specific requirements? | ||
| What are the core features provided by the solution (e.g., procurement, inventory management, supplier management, order management)? Does it support end-to-end supply chain visibility? | ||
| Does the solution offer advanced analytics and reporting? Are there AI and machine learning capabilities for predictive analysis and demand forecasting? | ||
| What security measures are in place to protect sensitive supply chain data? Is the solution compliant with relevant data protection regulations (e.g., NIST, CCPA, HIPAA, PCI-DSS, etc.)? | ||
| Does the solution support compliance with industry standards and regulations? How does it manage compliance documentation and audits? | ||
| What kind of training and support is offered by the vendor? Are there resources available for troubleshooting and learning (e.g., documentation, online forums, customer support)? | ||
| What performance metrics are available to measure the solution’s effectiveness? How does the solution ensure high availability and reliability? | ||
| What disaster recovery and business continuity measures are in place? How does the solution handle data backup and recovery? | ||
| Does the solution facilitate better collaboration with suppliers and partners? What communication tools are integrated within the solution for supply chain stakeholders? |
Phase 5
| Capabilities, Features and/or Specifications | Description of Service Offering | Additional Info |
| Identity Lifecycle Management | ||
| What are the core features of the ILM solution? Does it cover the entire lifecycle of identity management, from creation to deactivation? | ||
| How well does the solution integrate with existing systems, applications, and directories (e.g., Active Directory, HR systems)? | ||
| Does the solution provide automation for identity provisioning, deprovisioning, and lifecycle management processes? | ||
| Does the solution help in meeting regulatory requirements (e.g., NIST, CCPA, HIPAA, PCI-DSS, etc.)? | ||
| What security measures are in place to protect identity data? Does it support multi-factor authentication (MFA)? | ||
| Does the solution provide comprehensive audit trails and reporting capabilities for compliance and security monitoring? | ||
| How does the solution handle role-based access control (RBAC)? Can it support complex role hierarchies and dynamic roles? | ||
| Are there self-service capabilities for users to manage their own identities and access rights (e.g., password resets, access requests)? | ||
| Does the solution support delegated administration for different departments or organizational units? | ||
| How does the solution handle the provisioning of identities and access across different systems? | ||
| How efficiently does the solution manage the deprovisioning process to ensure timely revocation of access? | ||
| Does the solution provide reconciliation capabilities to ensure that identity data is consistent across all systems? | ||
| What is the performance like under heavy load? Are there any benchmarks or case studies available? | ||
| What level of support is provided by the vendor? Are there options for 24/7 support? | ||
| What training and documentation are available for administrators and users? | ||
| How often does the vendor update the solution? Are there regular updates and new feature releases? | ||
| Insider Threat Detection | ||
| What types of insider threats can the solution detect (e.g., data theft, sabotage, fraud, unintentional mistakes)? | ||
| Does the solution offer real-time monitoring and alerting? | ||
| Can the solution identify unusual user behavior and flag potential insider threats? | ||
| Does it support advanced analytics, such as machine learning or artificial intelligence, for threat detection? | ||
| Is there support for monitoring across multiple platforms and devices (e.g., desktop, mobile, cloud services)? | ||
| Does the solution provide risk scoring for users based on their behavior? | ||
| How well does the solution integrate with existing security infrastructure (e.g., SIEM, DLP, IAM systems)? | ||
| How seamless is the integration process, and what level of customization is required? | ||
| How does the solution handle sensitive data and ensure data privacy? | ||
| Does the solution comply with relevant regulations and industry standards (e.g., NIST, CCPA, HIPAA, PCI-DSS, etc.)? | ||
| Are there features to support audit and compliance reporting? | ||
| Are there customizable dashboards and reporting features? | ||
| Does the solution provide detailed incident response workflows and playbooks? | ||
| Are there capabilities for forensic analysis and investigation of insider threats? | ||
| How does the solution help in mitigating identified threats? | ||
| How does the solution perform under peak loads and in large-scale environments? | ||
| What is the expected impact on network and system performance? | ||
| What level of customer support does the vendor offer (e.g., 24/7 support, dedicated account managers)? | ||
| Does the solution provide detailed insights into user behavior and trends? | ||
| How does it distinguish between normal and suspicious activities? | ||
| What is the solution’s rate of false positives, and how does it minimize them? | ||
| Will the solution provide a risk register and plan of action and milestones? | ||
| Will the solution incorporate risk assessments at three tiers (enterprise, business, asset level)? | ||
| How accurate and reliable are the threat detection capabilities? | ||
| Network Access Control | ||
| Does the NAC solution support a wide range of network devices and endpoints? | ||
| Does it require agent installation for accurate profiling? | ||
| Can the solution identify and profile all devices attempting to connect to the network, including wired and wireless, managed and unmanaged? | ||
| Is it compatible with our current security solutions (e.g., firewalls, SIEM, antivirus)? | ||
| How does the solution handle increased traffic and a higher number of endpoints? | ||
| What types of authentication methods does the NAC solution support (e.g., 802.1X, MAC-based, web-based)? | ||
| How does the solution enforce security policies and manage endpoint compliance? | ||
| Does the NAC solution provide real-time threat detection and response capabilities? | ||
| What is the impact on end users in terms of connectivity and access? | ||
| Does the NAC solution provide a centralized management console for ease of administration? | ||
| What kind of reporting and logging capabilities are available? | ||
| How does the solution handle policy management and enforcement across multiple locations? | ||
| Can the NAC solution provide comprehensive visibility into all connected devices and users? | ||
| Does it offer granular control over network access based on user roles, device types, and other criteria? | ||
| What kind of support and training does the vendor provide? | ||
| Does the NAC solution help in meeting regulatory compliance requirements (e.g., NIST, CCPA, HIPAA, PCI-DSS, etc.)? | ||
| How does the solution ensure data privacy and protection? | ||
| How does the NAC solution impact network performance? | ||
| Are there any latency issues or bottlenecks introduced by the solution? | ||
| How does the NAC solution handle guest access and Bring Your Own Device (BYOD) scenarios? | ||
| Is there support for creating and managing guest networks with appropriate security controls? | ||
| How does the solution facilitate incident response and remediation? | ||
| Can it automatically isolate or remediate non-compliant or compromised devices? | ||
| Enterprise Encryption | ||
| What encryption algorithms and key lengths does the solution support? | ||
| Is it compliant with industry standards (e.g., FIPS 140-2, Common Criteria)? | ||
| How resistant is it to attacks (e.g., brute force, side-channel)? | ||
| How are encryption keys generated, stored, and rotated? | ||
| Does the solution integrate with hardware security modules (HSMs)? | ||
| Can you manage keys centrally across your organization? | ||
| What impact does encryption have on system performance (CPU, memory, I/O)? | ||
| Can it handle high data volumes and scale as your organization grows? | ||
| Does the solution support encryption at rest, in transit, and during processing? | ||
| How does it handle data backups, replication, and disaster recovery? | ||
| Is it compatible with existing infrastructure (databases, applications, cloud services)? | ||
| Does it work seamlessly across different platforms (Windows, Linux, mobile)? | ||
| Can it generate audit logs for encryption-related activities? | ||
| Does it meet regulatory requirements (e.g., NIST, CCPA, HIPAA, PCI-DSS, etc.)? | ||
| How transparent is the encryption process to end-users? | ||
| Does it impact user workflows or application performance? | ||
| Can the solution encrypt different types of data (e.g., files, emails, databases) and formats (e.g., structured , unstructured)? | ||
| What features are available for key recovery, data recovery, and redundancy to ensure data is not lost due to encryption issues? | ||
| Mobile Threat Defense | ||
| How does the solution identify threats and prevent malware, phishing attacks, etc.? Does it utilize real-time threat intelligence? | ||
| Does it scan apps for malicious behavior, vulnerabilities, and data leakage risks? | ||
| Does it offer features like device encryption, remote wipe, and jailbreak/rootkit detection? | ||
| Can it isolate or containerize work data to prevent unauthorized access? Does it offer encryption for data? | ||
| Does it provide a centralized console for policy management, device visibility, and reporting? | ||
| Does it support both corporate-owned and BYOD scenarios? Does it support all major mobile operating systems? | ||
| Does it integrate with other security tools (SIEM, SOAR) within the enterprise? | ||
| What is the impact on device performance and user experience? | ||
| How does the solution detect suspicious behavior on mobile devices? | ||
| What remediation actions does it offer for detected threats? | ||
| Does it meet regulatory requirements (e.g., NIST, CCPA, HIPAA, PCI-DSS, etc.)? |
Administrative
| Administrative, Billing/Invoicing, Reporting, and Oversight Requirements | Description of Service Offering | Additional Info |
| Administrative Functions | ||
| Can your solution provide a live data feed from the customer of record directly to our State Office of Information Security (OIS), Security Operations Center (SOC)? If so, could you detail how this integration would work and what protocols or standards would be used to ensure real-time data transmission and security. | ||
| Describe your online portal, features and the access customers have. Can your company provide oversight access to the CALNET Program? | ||
| Does your company have the ability to host CALNET related documents (example: Service Catalogs in PDF Format) on a publicly accessible area of your website for customers to access? | ||
| Can you meet the State's CONUS (Continental United States) requirements? If not, please explain what sort of waiver is required? | ||
| Does your company have the ability to assign dedicated resources to the CALNET Program and its customers? | ||
| Billing/Invoicing | ||
| How do you bill for services? Monthly, quarterly, annually, subscription based, or usage based, or hybrid billing model; please explain. | ||
| What pricing models do you offer (e.g., per device, per user, subscription-based)? | ||
| Do you offer an online invoicing system? Explain how your company provides access to customers for billing and invoicing data? | ||
| Does your invoicing system allow CALNET Staff to view all CALNET customer data? | ||
| Can you produce a complete and accurate invoice within 15 days of services being rendered? (e.g. service provided to a customer from January 1st - January 31st, then produce the invoice by February 15th) | ||
| Can you offer flexible bill cycles? | ||
| Explain your current invoicing support methods offered to customers? Support offered through an online portal, live chat, email or call center with live attendant etc.? | ||
| How is invoicing issued to customers? Paper, email or an online portal? What alternative invoice media types can you offer? | ||
| Does your company’s invoice include a remittance slip? Do the invoices provide a breakdown of charges? | ||
| Does your company have the ability to customize invoice content? If no, please explain limitations. | ||
| Do you have the ability to apply late payment charges on invoices? | ||
| Can your invoicing system accommodate requests for customized formatting of charges? |
Example: rates may extend past the decimal 4 digits, but then the total charge per line item on invoice will not extend past the decimal 2 digits.
| How are non-recurring products and services with no usage accounted for? |
| Does your company have the ability to collect an Administrative Fee from customers for services rendered and provide payment directly to the California Department of Technology? |
| Oversight |
| Please describe your Service Level Agreements (e.g., Availability, Uptime, Time to Mitigate, Real-time Alerting, etc.) |
| Do you have a method for prioritizing incidents and a timeframe for resolution? |
| What kind of customer support is available (e.g., 24/7 support, dedicated account manager)? |
| Are there training resources available, such as documentation, webinars, or on-site training? |
| Describe how Customers open and track trouble tickets. |
| Please describe your ability to meet Fed Ramp compliance and what levels you are able to support. |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .