Attachment E -Commonwealth's Response to Vendors' Written Questions RFB 758 2700000066.xlsx

XLSX spreadsheet 23 KB Posted

Attached to
Network Security Software, Hardware, and Services
Solicitation number
RFB 758 2700000066 3
Issued by
Elliott County, Kentucky

About this file

This file is the Commonwealth of Kentucky's response to vendors' written questions regarding RFB 758 2700000066, a network security software, hardware, and services solicitation for state agencies. The contract seeks to establish a master agreement for comprehensive cybersecurity solutions, including firewalls (Palo Alto, Check Point, Fortinet, Cisco), endpoint protection (Symantec, TrendMicro), email security (Proofpoint), cloud security platforms, vulnerability management tools (Rapid7), identity and access management solutions, and associated professional services including implementation, training, and break/fix support. Bidders must be authorized resellers for all products listed on the bid sheet and provide pricing across software, hardware, maintenance, support, implementation, consulting, and training service categories. The RFB specifies mandatory delivery within 15 calendar days, 24/7 technical support with one-hour initial response times, on-site technician arrival within 24 hours, and comprehensive security compliance requirements aligned to NIST 800-53 Rev 5 standards. One contract will be awarded to serve all Commonwealth agencies as an all-state contract vehicle.

Pricing shall reflect net costs for specified units and terms as detailed in line items, with vendors permitted to quote below contract pricing but not above it. The Commonwealth will consider subscription-based and cloud-delivered security services (SaaS, SASE, Zero Trust, cloud security posture management) within the contract scope. Future additions of new cybersecurity manufacturers and technologies emerging during the contract term are permitted subject to Commonwealth approval and required authorization documentation, with pricing adjustments governed by Section 15 processes. Vendors may satisfy certain reseller authorization requirements through qualified distributors or authorized subcontractors, with manufacturer-delivered training and OEM-backed support services acceptable as alternatives to direct vendor personnel. End-of-life product replacements and manufacturer-mandated equipment upgrades will be subject to good-faith price adjustment negotiations through formal contract modifications.

View the file

Other files

On GovTribe

Work with this file

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file

Text version

QA RFB 758 27-66

Attachment E - Commonwealth's Response to Vendors' Written Questions, RFB 758 2700000066
Network Security Software, Hardware, and Services
Question #RFB Section / Requirement NumberDocumentDocument Page NumberVendor QuestionsCommonwealth Response
1Attachment A, page 2RFB 758 27000000652Would you please confirm if we are required to provide copies of both Revenue Form 10A100 Kentucky Tax Registration Application and a Certificate of Authority – Registration with Secretary of State by a Foreign Entity with our bid submission?Both must be provided prior to contract award
2Attachment A: Section 2A, Authorized Reseller VerificationAttachment A2, 5Will distributor authorization letters be accepted for all listed cybersecurity vendors or only certain manufacturers?See updated RFB and updated Attachment B.
3Attachment A: Section 2A, Authorized Reseller VerificationAttachment A2, 5For manufacturers that have merged or changed ownership, what documentation is acceptable to demonstrate authorized resale status?See updated RFB and updated Attachment B. The same requirements apply.
4Attachment A, Section 2.A,RFB 758 27000000665You mentioned that all vendors that are bidding on this contract must be an authorized reseller of all products being consider for this bid. Do you have a complete list of vendors that you need an authorized reseller letter for?See updated RFB and updated Attachment B.
5Attachment A, Section 2Attachment A5Must the prime bidder itself hold direct reseller authorization from every manufacturer listed in the bid sheet at the time of bid submission, or may the bidder satisfy the requirement through manufacturer authorization letters/reseller agreements provided before award, as contemplated in the RFB?See updated RFB and updated Attachment B.
6Attachment A, Section 2.AAttachment A5If manufacturer authorization is supplied through an authorized distributor or qualified subcontractor supporting the prime, would that satisfy the requirement, or must each authorization name the prime bidder directly?See updated RFB and updated Attachment B.
7Attachment A: Sections 1 and 19, Scope of Contract and Estimated QuantitiesAttachment A5, 21–22Can the Commonwealth provide historical purchasing volumes for similar contracts?No. The current contract is an all state agency contract and that information is not available at this time.
8Section 2.A.1 - Authorized Reseller Verification (Mandatory Status)RFB5This is a Group All award requiring bidders to bid every line item and be an authorized reseller for all products on the contract, and the Bid Sheet spans products from more than ten different manufacturers. May a vendor satisfy the reseller-authorization requirement using a subcontractor's manufacturer authorization for specific product lines, or must the prime bidder itself hold direct authorization from every manufacturer listed?See updated RFB and updated Attachment B.
9RFB 758 27000000665Under the 3. Cybersecurity Exception - Prior to contract award, for cybersecurity products, a formal authorization letter from the specific distributor validating the vendor’s ability to resell those tools will be accepted - if you have a distributor letter does that replace the need for a vendor reseller authorization letter? Also, what product procurement circumstances would require distributors to provide a letter?See updated RFB and updated Attachment B.
10Section 2.A.4 Future AdditionsRFB5The solicitation references specific manufacturers and technologies as examples. Will awarded contractors be permitted to add new cybersecurity hardware, software, SaaS offerings, and associated OEMs that emerge during the contract term, subject to COT approval and required authorization documentation?See updated RFB and updated Attachment B and Section 26.
11Section 2A, 1Attachment A5Per the requirement "The vendor must be an authorized reseller for all products on the contract.", we see existing OEMs listed on page 7: Checkpoint Firewall, Palo Alto Firewall, TrendMicro, ProofPoint, Elastic & Symantec but there are also various other OEMs listed throughout Attachment A and B, including: Fortinet, Certes, Microsoft, OpenText, Forcepoint, Rapid7, DigiCert, RSA, and Cisco. Can the Commonwealth please clarify which OEMs the vendor must be an authorized reseller for/provide a letter for?See updated RFB and updated Attachment B.
12Section 2.B Software Product RequirementsRFBpages 5-6Will cloud-delivered security services and SaaS security platforms, including cloud security posture management, SASE, SSE, ZTNA, CASB, and cloud-native security analytics solutions, be considered within the scope of this contract?Yes
13Section 2.B Software Requirements and Section 2A Commonwealth IT RequirementsRFBpages 5-6 and 9-13Are there strategic technology areas the Commonwealth anticipates emphasizing during the contract term, such as Zero Trust, identity security, cloud security, security analytics, vulnerability management, or network segmentation?This will be an all state agency contract. This information is unknown at this time and not required to submit a response to the RFB. Please comply with the RFB requirements as outlined.
14Attachment A - Section 2, 18 and 26Attachment A5,6,7,25,26,27For products that may reach end-of-sale or end-of-support during the contract term, will successor products be allowed through future contract modifications? Further, are product component restraints an acceptble reason for a contract modification?See updated RFB and updated Attachment B and Section 26.
15Sections 2.B, 2.C, and 2.DRFBPages 5-7Can vendors provide integrated solutions consisting of hardware, software, support, and professional services under a single delivery order?These components can be combined and included on one (1) quote however the vendor must provide the components and the quote in accordance with the RFB requirements and pricing catalog.
16Section 2.B / 2.C - Software and Hardware Product RequirementsRFB / Bid Sheet5-7Section 2 lists Elastic (Unified Threat Management) and Proofpoint (Email/SMTP Relay) as required product categories, but neither appears as a priced line item on Attachment B - Bid Sheet. Should vendors also provide reseller authorization and/or pricing for Elastic and Proofpoint, or is required pricing limited strictly to the items listed on the Bid Sheet?See updated RFB and updated Attachment B.
17Attachment A: Section 2B–2C, Software and Hardware Product Requirements;Attachment A5–7Is there expected usage concentration around specific security platforms?This will be an all state agency contract. This information is unknown at this time and not required to submit a response to the RFB. Please comply with the RFB requirements as outlined.
18Attachment A: Sections 2B–2C and 18Attachment A5–7, 25Are the listed software and hardware products intended to represent currently shipping versions as of award date, or must pricing strictly reflect the versions identified in the bid sheet?See updated RFB and updated Attachment B.
19Attachment A: Sections 1–2, Scope of Contract and Bid SpecificationsAttachment A5–9Are there major agency refresh initiatives anticipated during the initial contract period?This will be an all state agency contract. This information is unknown at this time and not required to submit a response to the RFB. Please comply with the RFB requirements as outlined.
20RFB 758 27000000666Under Hardware Product Requirements - you state the following -'The hardware offerings must include, but are not limited to:' Does this mean, you will accept bids for other comparable firewall products not listed in this document? If so, how would you go about determining what's comparable or not?See updated RFB and updated Attachment B.
21ThroughoutRFBPage 6, 7, 9, 21What does delivery mean relative to the 15 day requirement? (Shipping, professional service, ETC...)See updated RFB and updated Attachment B.
22May the required implementation, training, break/fix, and 24x7 support obligations be performed by the applicable OEMs or authorized subcontractors while the awarded vendor remains fully responsible to the Commonwealth as prime?See updated RFB and updated Attachment B.
23RFB 758 27000000667Section D, 1 Support Rates: Can you clarify the request that 'The vendor must provide online and on-site software maintenance and support services billed on an hourly basis. Are there specific products you need maintenance rates for?See updated RFB and updated Attachment B.
24Existing Manufacturers Identified in Section 2.DRFBPage 7Is the Commonwealth seeking strategic modernization of currently identified platforms (Proofpoint, Palo Alto, Check Point, Elastic, TrendMicro, Symantec) during the contract term?This will be an all state agency contract. This information is unknown at this time and not required to submit a response to the RFB. Please comply with the RFB requirements as outlined.
25Section 2.D Maintenance, Support and ServicesRFB7May awarded vendors provide managed services associated with products purchased through the contract, including monitoring, administration, firewall management, SIEM support, vulnerability management, and security operations services?Yes, should it be requested. As an all state contract, there may be varying requirements. Some may require managed services, others will not.
26Attachment A - Terms and ConditionsAttachment A8Does the initial contact one-hour response requirement apply to acknowledgment of receipt, engagement by a technician, or issue resolution?See updated RFB and updated Attachment B.
27Attachment A - Terms and ConditionsAttachment A8The hardware/software line items in Attachment B bundle manufacturer-backed support and maintenance packages. Will the Commonwealth clarify if this 24/7 requirement is product-specific and satisfied by the respective OEM technical support centers, or does the Commonwealth expect the reseller to maintain its own independent 24/7 general technical helpdesk?See updated RFB and updated Attachment B.
28Attachment A - Section 2Attachment A8Is remote support considered acceptable before dispatching on-site personnel?See updated RFB and updated Attachment B.
29Section 2, Part F SLA & Response TimesAttachment A8The solicitation states that 'an on-site technician should arrive and resolve the issue within twenty-four (24) hours,' while noting that 'this is a reseller contract and some aspects of resolution may be outside the control of the reseller.' Because the hardware and software maintenance line items listed on Attachment B are manufacturer-backed support packages, will the Commonwealth confirm that this on-site resolution requirement is satisfied by the manufacturer’s certified support services rather than the reseller's direct personnel?See updated RFB and updated Attachment B.
30Attachment A: Section 2E, Training RequirementsAttachment A8–9Are virtual instructor-led training courses considered off-site training?See updated RFB and updated Attachment B.
31Attachment A: Section 2E, Training RequirementsAttachment A8–9Should on-site pricing assume travel within Kentucky only?See updated RFB and updated Attachment B.
32Attachment A: Sections 2E and 32, Training Requirements and SubcontractsAttachment A8–9, 30–31Can manufacturer-delivered training be subcontracted directly through the OEM training division?See updated RFB and updated Attachment B.
33Attachment A - Terms and ConditionsAttachment A9Does delivery time begin upon receipt of the agency order, receipt of OEM confirmation or vendor order confirmation?See updated RFB and updated Attachment B.
34Attachment A: Section 2G, DeliveryAttachment A9May vendors identify product-specific delivery exceptions for factory-built hardware platforms?See updated RFB and updated Attachment B.
35Section 2.HAttachment A9Section 2.H requires the vendor to retain system logs for at least 90 days and offer extended retention. Vendor understands this requirement to apply only when the contractor provides a hosted or managed service and has custody or control of the logs, and not to require the reseller to collect or retain logs generated by customer-operated products. Can the Commonwealth please confirm?See updated RFB and updated Attachment B. This is correct in that it is a requirement of the vendor when hosted. Solutions procured through this contract must be able to support this regardless of hosting environment.
36Section 2.K Expedited Requests and Section 22 FOB DestinationRFBpages 9 and 26For expedited deliveries specifically requested by using agencies, may associated shipping premiums be separately identified and approved?See updated RFB and updated Attachment B.
37Attachment A: Sections 10–11, Security and Compliance RequirementsAttachment A10–14Do these security requirements apply only to services delivered under the contract or to all OEM-provided cloud services?This applies to all contracted software, hardware and services outlined in the RFB.
38Attachment A: Sections 10–12, Security and Compliance RequirementsAttachment A10–17Are third-party compliance reports acceptable evidence of security controls?Yes as long as the third party compliance reports map well to NIST-800-53 Rev 5 and cover remarkably similar controls.
39Attachment A: Sections 10–12, Security and Compliance RequirementsAttachment A10–17Does the Commonwealth require any formal security questionnaire during the award process?No.
40Section 2A.5 - License AgreementsRFB11Manufacturer EULAs (e.g., Palo Alto, Checkpoint) typically include their own governing-law and venue clauses. If a manufacturer's standard EULA cannot be edited to include the required Kentucky governing-law language verbatim, is a rider/addendum incorporating that language by reference acceptable for COT review, or must the base EULA itself be revised?A rider or addendum is acceptable as long as it references the awarded vendor's name and contract number as the reseller.
41Attachment A - Terms and ConditionsAttachment A11,12Would the contract allow any of the solutions be procured XaaS?This is an all state contract and would be dependent on the individual agency and establish scope of work.
42Attachment A, Section 2A.9RFB 758 270000006612Number 9, Application and Service Requirements - in this section you reference the need to ensure that all quoted items on the basket list of products interface with the existing COT enterprise applications and infrastructure out of the box? If yes, how would this bidding vehicle show or validate that interoperability?It is the responsibility of the vendor to be familiar with the established KITS standards and attest to interoperability with these standards. See Section 2A(2).

Reference: https://technology.ky.gov/about-the-agency/Documents/KITS_Report.pdf

432A, Part 7.A Non-On Prem Solutions & Part 7.B(4) IaaSAttachment A12These sections require the vendor to provide an exit strategy, return all agency data in standard formats, and certify complete data destruction. Because the contractor is a reseller and does not host, store, or have administrative access to Commonwealth data, will the Commonwealth clarify that these data ownership, return, migration, and destruction obligations are to be fulfilled by the respective manufacturers/publishers in accordance with their standard End User License Agreements (EULAs) or service terms (submitted under Section 2A.5), and that the reseller carries no direct data-custody or data-migration liability?"This can be determined on a per purchase basis through EULAs, Purchase Agreements, Statements of work, or other mechanisms.
44Section 2A.12 - IRS Publication 1075 Safeguarding LanguageRFB14-17The scope of work in Section 2 (network security software, hardware, and services) does not describe any handling of Federal Tax Information (FTI). Can the Commonwealth confirm whether Section 2A.12 is applicable to this specific contract, or whether it is standard boilerplate not triggered by this scope of work?Because solutions may be procured by agencies that house and process FTI, and security logs may include incidental FTI, these requirements are included in the bid.
45Section 3RFB18Can you confirm whether the solicitation allows for more than one contract award to be issued?One (1) contract will be awarded as a result of this RFB.
46Attachment A, Section 8RFB 758 270000006619Section 8 Alternate Brands/Specifications - If a vendor proposed a different product than the ones listed in the RFB, what documentation would they need to suppply for that product to be consider as a 'comparable product' to the ones listed in the RFB?See updated RFB and updated Attachment B.
47Section 11 Agencies to be ServedRFB20Will counties, municipalities, educational institutions, and other political subdivisions be permitted to utilize the resulting contract under the same terms and conditions as Commonwealth agencies?See updated RFB and updated Attachment B.
48Section 13(A) Software Pricing EvaluationRFB20-22For subscription-based software licenses, should pricing reflect first-year subscription costs only or total contract value for the subscription term?See updated RFB and updated Attachment B.
49Section 13.C Services Hourly RateRFB21-22Will all labor categories be weighted equally for evaluation purposes, or will certain labor categories receive greater emphasis during scoring?See updated RFB and updated Attachment B.
50Section 13RFB 758 270000006622How does the Reciprocal preferences classification impact the the scoring criteria listed on page 21?Best Value scoring is subject to Reciprocal preference for Kentucky resident bidders and Preferences for a Qualified Bidder or the Department of Corrections, Division of Prison Industries (KAR 200 5:410).
51Attachment A - Measurable Criteria EAttachment A22With the current channel operations unpredictability (CTO/Two-Tier Channel Logistics/Component & Freight bottlenecks), will the Commonwealth consider revising the delivery language to match previous RFPs, which established a more commercially viable standard: 'All orders shall be delivered within fifteen (15) business days after receipt of order but shall not exceed thirty (30) calendar days... When delivery is not made within thirty (30) calendar days, one percent (1%) per day shall be deducted... unless a delivery exception was communicated by the vendor and accepted by the Commonwealth'?"See updated RFB and updated Attachment B.
52Attachment A: Section 14E, Measurable Criteria—DeliveryAttachment A22How will delivery scoring be evaluated when products are impacted by manufacturer lead times beyond reseller control?See updated RFB and updated Attachment B.
53Section 15 Price AdjustmentsRFB24-25When manufacturers implement broad-based pricing increases, will awarded vendors be permitted to update pricing upon approval consistent with Section 15 Price Adjustments?Section 15 outlines the process for increases and decreases.
54Section 15 Price RevisionsRFB24-25Will agencies be permitted to request additional manufacturer special bid pricing below contract pricing for large or strategic opportunities?The Commonwealth's expectation is for the awarded vendor to provide volume pricing in such cases. Vendors can always quote less than the contract pricing, but cannot quote more.
55Section 18 EquipmentAttachment A25-26The solicitation states that if advanced technology equipment is installed by mutual agreement, the 'price of the new technology equipment cannot exceed the cost of the award contract.' In the event that a contracted hardware model is designated End-of-Life by the manufacturer and its mandatory replacement model carries a higher manufacturer cost, a reseller cannot absorb this cost differential. Will the Commonwealth clarify that if a manufacturer-mandated replacement product carries a higher cost, the parties will negotiate a price adjustment in good faith via a formal contract Modification (per Section 26) or utilize the Price Increase process outlined in Section 15.ASee updated RFB and updated Attachment B.
56Section 26 Addition or Deletion of Items or ServicesRFB27For manufacturers and technologies added after contract award, may vendors submit updated catalogs and pricing schedules throughout the contract term without requiring a separate competitive procurement?See updated RFB and updated Attachment B.
57Section 2.A.4 Future Additions and Section 26 Contract ModificationsRFB5 and 27For hardware pricing evaluation, will all categories be weighted equally, or will anticipated buying volumes influence scoring calculations?See updated RFB and updated Attachment B.
58Section 2.E Technical and Product Training; Section 13.D TrainingRFB8 and 22Will delivery-time scoring be based upon committed standard delivery times for all products, or may product categories have different delivery commitments?See updated RFB and updated Attachment B.
59Section 46 Artificial IntelligenceRFB35May vendors add AI-enabled cybersecurity solutions, threat detection capabilities, and security operations technologies introduced after contract award if the products otherwise meet all Commonwealth requirements?See updated RFB and updated Attachment B.
60Section 47.B.2 - Professional Liability InsuranceRFB36Section 47.B.2 requires Professional Liability (Errors & Omissions) Insurance "for all professional services performed by licensed or certificated individuals." Can the Commonwealth clarify whether this refers to state-issued professional licenses, industry/vendor certifications (e.g., GIAC, CISSP, manufacturer certifications), or both?This would refer to anyone performing professional services for the contract.
61Section 47, B2Attachment A36Regarding the Professional Liability insurance requirement, technology industry risks are typically addressed through coverage more specifically aligned to the services being performed, including Products-Completed Operations and Technology/Cyber Errors & Omissions (E&O) coverage. Would the Commonwealth consider modifying this requirement to remove the separate Professional Liability insurance requirement and instead permit Vendors to satisfy the requirement through applicable Products-Completed Operations and Technology/Cyber E&O coverage, provided such coverage meets the Commonwealth’s required limits?See updated RFB.
62Attachment B - Bid SheetAttachment B2To ensure pricing parity across respondents, could you please include part numbers for the requested hardware items? Several models have different form factors.See updated RFB and updated Attachment B.
63Attachment B - Bid SheetAttachment B1,2,3Should quoted maintenance and subscription pricing include all standard OEM support levels or only manufacturer base support?See updated RFB and updated Attachment B.
64Software Pricing TableBid SheetTable 0 - Software PricingThe OpenText Fortify Static Code Analyzer and Forcepoint ONE Secure Web Gateway line items do not specify a user/seat count or number of applications, unlike other lines (e.g., Symantec's 40,000-endpoint tier, RSA's 700-user tier). What quantity should vendors use as the pricing basis for these two items?See updated RFB and updated Attachment B.
65Software Pricing Table / Hardware Pricing Table - Column Header "Net Price for the Commonwealth"Bid SheetTable 0 - Software Pricing; Table 1 - Hardware PricingThe pricing column on both the Software and Hardware Pricing tables is headed "Net Price for the Commonwealth," but individual line items specify different pricing units (e.g., per user, per certificate, per endpoint) and different coverage periods (e.g., one year, three years). Can the Commonwealth confirm that the Net Price requested for each line is simply the total net cost for the unit/term stated in that line's description (e.g., total cost for 1200 certificates over 2 years, total cost for 700 users over 3 years), rather than a per-unit or annualized price?See updated RFB and updated Attachment B.
66Hardware Pricing TableBid SheetTable 1 - Hardware PricingFor the Palo Alto PA-7500, PA-5500, and PA-1410 lines, which ask vendors to "quote the base model," is there a minimum throughput, capacity, or license bundle the Commonwealth expects, or is any manufacturer base SKU acceptable?See updated RFB and updated Attachment B.
67HardwareAttachment B2The Cisco secure firewall 4115 has gone end of sale. Can pricing be substituted for the next gen 4215?See updated RFB and updated Attachment B.
68Attachment B - Bid SheetAttachment B2The Fortinet Fortigate-400F – including 2 years maintenance is end of life. Can you change the pricing request to Fortinet Fortigate-400G with respective part number?See updated RFB and updated Attachment B.
69Section 8; Attachment B Sections A and BAttachment BRFB 19-20; Attachment B 1-2If a listed product is no longer available or does not clearly identify an orderable SKU, will the Commonwealth provide the correct SKU or approve the current replacement product by addendum?See updated RFB and updated Attachment B.
70Section 2.B ; Section 2.C; Section 2.DAttachment BRFB 6-7; Attachment B 3Sections 2.B and 2.C make the vendor responsible for installation and ongoing maintenance, while Attachment B prices Implementation, Technical Consulting, and Break/Fix separately. Can the Commonwealth please confirm these services can be ordered and billed separately and do not need to be included in the product pricing unless specifically stated in the line item.See updated RFB and updated Attachment B.
71Section 2.E; Attachment B Section DAttachment BRFB 7-8; Attachment B 3Attachment B requires an all-inclusive price for on-site manufacturer-specific training for ten attendees, including instructor travel and lodging. What location should bidders assume for pricing the training?See updated RFB and updated Attachment B.
72Training Services TableBid SheetTable 3 - Training ServicesThe on-site and off-site training columns for PaloAlto, TrendMicro TippingPoint, and OpenText Fortify WebInspect appear to repeat identical header text in both columns. Can the Commonwealth confirm the intended structure - i.e., a single combined price per manufacturer per delivery mode (on-site/off-site)?See updated RFB and updated Attachment B.

File details come from the government source that posted it. Updated .