Attachment H - SecureServiceEdge Requirements Matrix_S-10700-00017534.xlsx
XLSX spreadsheet 30 KB Posted
- Solicitation number
- S-10700-00017534
- Issued by
- Oregon
About this file
This is a requirements matrix attachment for a Request for Proposal (RFP) issued by Oregon's Department of Administrative Services, State Procurement Services on behalf of the Enterprise Information Services, for a Secure Service Edge (SSE) solution. The RFP seeks a comprehensive SSE platform that integrates zero-trust network access, advanced threat protection, real-time monitoring, and compliance capabilities to secure both cloud-based and on-premises resources across the state's hybrid infrastructure. The solution must support secure remote workforce access, enforce granular security policies, provide centralized management across multiple tenants and administrators, and deliver seamless integration with existing enterprise systems including identity and access management platforms, Security Information and Event Management (SIEM) tools, and endpoint protection systems.
The requirements matrix contains 25 mandatory requirements and 18 desirable requirements that proposers must address with yes or no responses accompanied by detailed explanations of how their system meets each requirement. Mandatory requirements encompass proof of concept capability, real-time monitoring and threat detection, compliance logging with SIEM integration, end-to-end encryption using TLS 1.3 or higher, scalability to support 50,000 concurrent users, 99.99% high availability with redundant global data centers, disaster recovery with 30-minute RTO and 15-minute RPO, sub-100ms latency for 95% of global users, multi-administrator role-based access controls, secure multi-tenant architecture, 24x7x365 enterprise support with documented SLAs, fully documented and supported APIs enabling infrastructure-as-code integration, customizable compliance reporting, and identity-centric cloud application control. Desirable requirements include flexible licensing models, threat intelligence integration, behavioral analytics, advanced data loss prevention, secure web gateway functionality, endpoint isolation, incident response automation, and compatibility with major operating systems and unmanaged devices. Proposers that answer "no" to any mandatory requirement will face proposal rejection, while desirable items answered "no" may indicate planned future enhancements with specific availability dates.
View the file
Other files
Show all 14
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions
| RFP# | RFP Name | Proposer |
| Instructions: | ||
| 1. Proposer shall respond to each requirement in both the Mandatory and Desirable sheets. The response must be yes or no for each item. For each yes response, proposer shall explain how their system meets the requirement. | ||
| 2. For the Mandatory items, if a proposer answers the question no, their proposal will be rejected. | ||
| 3. For the Mandatory items, if a propoers answers yes, but does not explain how their system meets the requirement, the State may ask for clarification or reject the proposal. | ||
| 4. For the Desirable items, if a proposer answers no, they can indicate if that requirement is going to be part of a future enhancement or release and the date of the enhancement or release. | ||
| 5. If the proposer does not answer yes or no for a Desireable item it will given a 0 for that requirement. | ||
| 6. If the proposer does not explain how their sytem meets the requirement the Desireable item will be given a 0 for that requirement. |
Mandatory Requirements
| Requirement ID | Evaluation Category | Category | Gartner ZTNA Category | Requirement Description | Scorecard Alignment | Priority | Currently Available? (Yes/No) | Describe how solution meets Requirement |
| M-01 | Technical and Functional Requirements | Proof of Concept (PoC) | Service Delivery Requirements | Allow for a time-bound proof of concept to demonstrate solution performance and compatibility with agency systems before full implementation. | Formal Proof of Concept Capability | Mandatory | ||
| M-02 | Technical and Functional Requirements | Real-Time Monitoring | Operations Requirements | Provide real-time monitoring of user activities, application access, network traffic, and policy violations, with configurable alerts and dashboards to enhance visibility into potential threats or performance issues. | Real-Time Activity Monitoring | Mandatory | ||
| M-03 | Security and Compliance Features | Logging and Compliance | Operations Requirements | Generate detailed logs that meet compliance standards (e.g., CJIS, FTI) | Compliance Logging & SIEM Integration | Mandatory | ||
| M-04 | Security and Compliance Features | Logging and Compliance | Operations Requirements | Secure log storage, advanced query options, and automated export to SIEM tools like Splunk or Sentinel for centralized analysis and auditing. | Secure Log Management & SIEM Integration | Mandatory | ||
| M-05 | Performance, Scalability, and Resilience | Digital Experience Monitoring | Operations Requirements | Provide end-to-end visibility into user experience across cloud and private applications, including metrics such as latency, application responsiveness, session quality, and error rates. Enable proactive alerting and diagnostics to identify performance degradation and support SLA adherence. | End-to-End User Experience Visibility | Mandatory | ||
| M-06 | Performance, Scalability, and Resilience | Scalability | Availability & Resilience | Ensure horizontal scaling to support a minimum of 50,000 concurrent users | Large-Scale Concurrent User Support | Mandatory | ||
| M-07 | Performance, Scalability, and Resilience | Availability | Availability & Resilience | Deliver high availability with a guaranteed uptime of 99.99%, supported by globally distributed data centers, redundant paths, and automated failover mechanisms to ensure uninterrupted access to critical services. | 99.99% High Availability Architecture | Mandatory | ||
| M-08 | Performance, Scalability, and Resilience | Disaster Recovery | Availability & Resilience | Include disaster recovery mechanisms capable of meeting an RTO of 30 minutes and an RPO of 15 minutes, with geographically redundant backups and automated failover testing. | Defined Disaster Recovery Objectives | Mandatory | ||
| M-09 | Performance, Scalability, and Resilience | Low-Latency Access | Availability & Resilience | Maintain latency below 100ms for 95% of global users, leveraging geographically distributed PoPs and smart routing algorithms to prioritize critical traffic. | Sub-100ms Global Latency Assurance | Mandatory | ||
| M-10 | Security and Compliance Features | Encryption | Technology Requirements | Enforce end-to-end encryption for all communications using TLS 1.3 or higher, with secure key exchange protocols and support for perfect forward secrecy to protect against data interception. | Strong End-to-End Encryption Controls | Mandatory | ||
| M-11 | Security and Compliance Features | Advanced Threat Protection | Technology Requirements | Include advanced threat protection features such as machine learning-based malware detection, sandboxing for suspicious files, DNS security, and anomaly detection to proactively mitigate risks in real-time. | Advanced Real-Time Threat Prevention | Mandatory | ||
| M-12 | Security and Compliance Features | Data Residency | Technology Requirements | Ensure compliance with regional data residency regulations by offering configurable data localization options to restrict sensitive data to specific geographic regions as required by state or agency policies. | Configurable Data Residency Controls | Mandatory | ||
| M-13 | Security and Compliance Features | Remote Access Security | Technology Requirements | Enforce granular policies for remote workforce access, including location-based restrictions and device posture validation. | Secure Remote Workforce Controls | Mandatory | ||
| M-14 | Security and Compliance Features | Encryption Key Management | Technology Requirements | Support integration with key management systems (KMS) to enable agency control over encryption keys and meet compliance requirements. | Key Management System Integration | Mandatory | ||
| M-15 | Security and Compliance Features | Audit Trail Completeness | Technology Requirements | Provide immutable audit trails with detailed logs of administrative actions, security events, and user activities for compliance and forensic investigations. | Immutable Audit Logging | Mandatory | ||
| M-16 | Technical and Functional Requirements | General Requirements | User Functionality | Provide secure, unified access to both cloud-based and on-premises resources through a centralized, integrated platform that supports consistent security policies and seamless user experience across hybrid environments. | Unified Hybrid Access Platform | Mandatory | ||
| M-17 | Technical and Functional Requirements | Zero Trust Network Access (ZTNA) | User Functionality | Enforce ZTNA principles, verifying both user identity and device posture before granting access, while continuously re-evaluating trust levels during sessions based on behavioral anomalies or policy changes. | Continuous Zero Trust Enforcement | Mandatory | ||
| M-18 | Technical and Functional Requirements | Centralized Management | User Functionality | Support multi-administrator environments with role-based access controls that allow administrators to manage only their assigned users, applications, and policies. Ensure audit logging of administrative actions and support policy segmentation across teams or agencies. | Multi-Administrator Segmented RBAC | Mandatory | ||
| M-19 | Technical and Functional Requirements | Multi-tenancy Support | User Functionality | Provide centralized multitenancy support for managing multiple agencies and tenants with separate policies, data segregation, and access controls. The solution shall allow administrators to view and manage all authorized tenants from a unified console and shall support bulk policy administration, configuration updates, and reporting across tenants without requiring repeated manual changes in each tenant. | Secure Multi-Tenant Architecture | Mandatory | ||
| M-20 | Vendor Reputation, Support Quality, and Ease of Use | Support Model | Service Delivery Requirements | Provide 24x7x365 enterprise support with documented response and resolution SLAs, defined escalation procedures, and clearly identified support tiers. | 24x7 Enterprise Support & SLA | Mandatory | ||
| M-21 | Vendor Reputation, Support Quality, and Ease of Use | Implementation Methodology | Service Delivery Requirements | Provide a documented implementation and onboarding methodology, including project governance structure, migration planning, risk mitigation strategy, and estimated deployment timelines. | Structured Implementation Methodology | Mandatory | ||
| M-22 | Technical and Functional Requirements | Centralized Management | Service Delivery Requirements | All aspects of the SSE platform shall be fully manageable through well-documented, stable, and supported APIs. This includes configuration, policy management, onboarding, updates, administrative actions, and reporting. API functionality shall be fully supported in commercial and government environments, including GCC or equivalent public-sector deployments, and shall not be limited to preview-only or partially functional capability. API support shall enable integration with infrastructure-as-code and automation tools such as Ansible and Terraform. | API-Driven Management and Automation | Mandatory | ||
| M-23 | Technical and Functional Requirements | Reporting | User Functionality | Provide customizable reporting dashboards with drill-down capabilities, automated report scheduling, and export of data in multiple formats for compliance audits, operational analysis, and executive reviews. Reporting shall allow administrators to export detailed underlying data, including affected users, applications, policies, sessions, and administrative actions, so the State can independently analyze policy impact and security outcomes. | Customizable Compliance Reporting | Mandatory | ||
| M-24 | Security and Compliance Features | Identity-Based CASB Mapping | User Functionality | Provide user-to-application visibility and support identity-based policy enforcement for cloud applications. The solution shall not rely solely on device-based grouping or endpoint scoping to determine application access, monitoring, or policy enforcement; rather is shall be user focused. | Identity-Centric Cloud Application Control | Mandatory | ||
| M-25 | Technical and Functional Requirements | Policy Dependency Isolation | Technology Requirements | The solution shall not require shared grouping, tagging, or policy constructs that create conflicts with other security platform capabilities or prevent a user or device from participating in multiple required controls. Vendors shall describe any dependencies or limitations that constrain simultaneous use of security features. | Nonconflicting Cross-Platform Policy Design | Mandatory |
Desirable Requirements
| Requirement ID | Evaluation Category | Category | Gartner ZTNA Category | Requirement Description | Scorecard Alignment | Priority | Currently Available? (Yes/No) | Describe how solution meets Requirement | Available in an upcoming release? (Yes/No) | Describe how solution meets Requirement and when the feature will be available |
| SSE-01 | Total Cost of Ownership (TCO) | Transparent Pricing | Service Delivery Requirements | Provide a detailed breakdown of costs, including per-user licensing, onboarding, training, professional services, and ongoing maintenance, with clear options for scaling and volume discounts. | Transparent Scalable Cost Structure | Desirable | ||||
| SSE-02 | Total Cost of Ownership (TCO) | Licensing Flexibility | Service Delivery Requirements | Offer flexible licensing models (e.g., per user, per device, or consumption-based) to accommodate diverse agency needs. | Flexible Multi-Model Licensing | Desirable | ||||
| SSE-03 | Security and Compliance Features | Threat Intelligence | Operations Requirements | Incorporate global threat intelligence feeds to identify and respond to emerging risks, with automated updates to policies and protections against newly discovered vulnerabilities or attack vectors. | Automated Global Threat Intelligence | Desirable | ||||
| SSE-04 | Security and Compliance Features | Baseline and Anomaly Detection | Operations Requirements | Leverage AI/ML tools to detect baseline patterns and flag anomalies in network traffic or user behavior, enabling proactive incident management. | AI-Driven Behavioral Analytics | Desirable | ||||
| SSE-05 | Performance, Scalability, and Resilience | Scalability | Availability & Resilience | Performance monitoring to prevent bottlenecks during high-demand periods, including burst traffic scenarios. | High-Demand Performance Monitoring | Desirable | ||||
| SSE-06 | Performance, Scalability, and Resilience | Performance Optimization | Availability & Resilience | Optimize network performance using techniques like global CDN caching, traffic compression, and dynamic load balancing to minimize latency and enhance user experience, particularly for remote workers. | Global Traffic Optimization Controls | Desirable | ||||
| SSE-07 | Performance, Scalability, and Resilience | Adaptive Scaling | Availability & Resilience | Automatically adjust resources and infrastructure to accommodate traffic growth, including temporary surges, without manual intervention or service disruption. | Automatic Elastic Resource Scaling | Desirable | ||||
| SSE-08 | Performance, Scalability, and Resilience | Global Infrastructure | Availability & Resilience | Ensure a globally distributed infrastructure with edge computing capabilities to reduce latency for end-users in remote locations. | Global Edge Infrastructure Deployment | Desirable | ||||
| SSE-09 | Performance, Scalability, and Resilience | Bandwidth Optimization | Availability & Resilience | Dynamically adjust bandwidth allocation based on real-time traffic patterns and criticality of applications. | Dynamic Bandwidth Prioritization | Desirable | ||||
| SSE-10 | Performance, Scalability, and Resilience | Redundancy | Availability & Resilience | Ensure redundancy at every layer, including gateways, load balancers, and cloud endpoints, to minimize single points of failure. | Full-Stack Redundancy Design | Desirable | ||||
| SSE-11 | Security and Compliance Features | Role-Based Access Control (RBAC) | Technology Requirements | Provide granular RBAC capabilities that support dynamic policy adjustments based on user roles, device posture, location, and time of access, ensuring least-privilege access principles are upheld. | Context-Aware Role-Based Access | Desirable | ||||
| SSE-12 | Security and Compliance Features | Multi-Factor Authentication | Technology Requirements | Integrate with MFA systems (e.g., Duo, Okta, Microsoft Authenticator) and enforce context-aware MFA policies based on user behavior, resource sensitivity, and access location. | Context-Aware MFA Integration | Desirable | ||||
| SSE-13 | Security and Compliance Features | Behavioral Analytics | Technology Requirements | Implement User and Entity Behavioral Analytics (UEBA) to monitor for anomalies, such as unusual login times or abnormal data access patterns and generate automated responses to mitigate potential insider or external threats. | User & Entity Behavioral Analytics | Desirable | ||||
| SSE-14 | Security and Compliance Features | Data Loss Prevention (DLP) | Technology Requirements | Incorporate advanced DLP capabilities to identify, monitor, and control the movement of sensitive data across cloud and network environments, with options for automated incident response and blocking. | Enterprise Data Loss Prevention | Desirable | ||||
| SSE-15 | Security and Compliance Features | Secure Web Gateway (SWG) | Technology Requirements | Include SWG functionality for URL filtering, application control, and protection against phishing, malware, and unauthorized web access to ensure secure browsing across all endpoints. | Secure Web Gateway Protection | Desirable | ||||
| SSE-16 | Security and Compliance Features | Policy Enforcement | Technology Requirements | Allow dynamic, granular policy enforcement and scoping at multiple levels, including user, group, application, session, device, location, and tenant, to adapt to changing risk scenarios and ensure compliance with security frameworks. Administrators shall be able to view, edit, and validate the effective scope of a policy or application tag without removing and recreating the policy object. | Multi-Layer Dynamic Policy Enforcement | Desirable | ||||
| SSE-17 | Security and Compliance Features | Threat Containment | Technology Requirements | Provide automated threat containment capabilities, such as isolating compromised devices or restricting access for anomalous user activity. | Automated Threat Containment | Desirable | ||||
| SSE-18 | Security and Compliance Features | Secure APIs | Technology Requirements | Enforce security for APIs with authentication, rate limiting, and monitoring to prevent abuse or exploitation. | Secure API Protection Controls | Desirable | ||||
| SSE-19 | Security and Compliance Features | Compliance Templates | Technology Requirements | Provide predefined templates for common compliance frameworks (e.g., CJIS, GDPR) to simplify implementation and auditing. | Prebuilt Compliance Framework Templates | Desirable | ||||
| SSE-20 | Security and Compliance Features | Endpoint Isolation | Technology Requirements | Enable endpoint isolation capabilities to limit data exposure or lateral movement during a security incident. | Endpoint Isolation Capabilities | Desirable | ||||
| SSE-21 | Security and Compliance Features | Policy Simulation | Technology Requirements | Include tools for simulating the impact of new or updated security policies before applying them in production. | Pre-Deployment Policy Simulation | Desirable | ||||
| SSE-22 | Security and Compliance Features | Data Masking | Technology Requirements | Enable data masking features to protect sensitive information during processing or reporting, ensuring privacy compliance. | Data Masking for Privacy Protection | Desirable | ||||
| SSE-23 | Security and Compliance Features | Incident Response Automation | Technology Requirements | Automate incident response workflows, including notification, isolation, and remediation steps, to reduce response time and human error during crises. | Automated Incident Response Orchestration | Desirable | ||||
| SSE-24 | Technical and Functional Requirements | Integration | User Functionality | Support seamless integration with IAM solutions, including LDAP, Active Directory (AD), Azure AD, and Google Workspace, ensuring secure user authentication and policy enforcement across existing infrastructure. | Enterprise IAM Integration | Desirable | ||||
| SSE-25 | Technical and Functional Requirements | Compatibility | User Functionality | Ensure compatibility with major operating systems and browsers, including secure, agentless access for legacy systems—defined as applications or platforms that cannot support endpoint agents or browser extensions (e.g., older operating systems, thick-client applications, infrastructure management interfaces, or third-party systems). | Agentless Legacy System Access | Desirable | ||||
| SSE-26 | Technical and Functional Requirements | API Support | User Functionality | Provide comprehensive RESTful APIs for integration with third-party systems, including SIEMs, ITSM tools, and cloud management platforms, enabling automation and seamless interoperability across tools. | Comprehensive API Integration Framework | Desirable | ||||
| SSE-27 | Technical and Functional Requirements | Unmanaged Device Support | User Functionality | Provide secure access for unmanaged devices using browser-based access (agentless) and implement device posture checks for compliance with security policies prior to granting access. | Secure Agentless Device Access | Desirable | ||||
| SSE-29 | Technical and Functional Requirements | Integration | User Functionality | Enable seamless integration with endpoint protection platforms (e.g., CrowdStrike, SentinelOne) to share threat intelligence and enforce endpoint compliance checks dynamically. | Endpoint Security Platform Integration | Desirable | ||||
| SSE-31 | Technical and Functional Requirements | Secure Cloud Connectivity | User Functionality | Enable direct, secure connectivity to major cloud service providers (e.g., AWS, Azure, GCP) to optimize latency and bandwidth usage. | Direct Secure Cloud Connectivity | Desirable | ||||
| SSE-32 | Technical and Functional Requirements | Hybrid Integration | User Functionality | Support hybrid deployments with consistent policy enforcement and visibility across cloud and on-premises environments. | Consistent Hybrid Policy Enforcement | Desirable | ||||
| SSE-33 | Technical and Functional Requirements | Security Posture Dashboard | User Functionality | Provide a comprehensive dashboard showing real-time security posture, including compliance metrics, threat trends, and risk assessments. | Real-Time Security Posture Visibility | Desirable | ||||
| SSE-34 | Technical and Functional Requirements | SaaS Integration | User Functionality | Integrate with popular SaaS platforms (e.g., Salesforce, Microsoft 365) for enhanced visibility and control of cloud applications. | SaaS Application Security Integration | Desirable | ||||
| SSE-35 | Vendor Reputation, Support Quality, and Ease of Use | Vendor Organizational Maturity | Service Delivery Requirements | Demonstrate a minimum of five (5) years delivering Secure Service Edge (SSE), SASE, or Zero Trust services at enterprise scale, including documented experience supporting U.S. state or large public-sector organizations. | Public Sector SSE Experience & Maturity | Nice to Have | ||||
| SSE-36 | Vendor Reputation, Support Quality, and Ease of Use | Customer References | Service Delivery Requirements | Provide at least three (3) customer references from comparable public-sector or regulated environments, including contact information and scope of deployment. | Verified Public Sector References | Desirable | ||||
| SSE-37 | Vendor Reputation, Support Quality, and Ease of Use | Financial Stability | Service Delivery Requirements | Provide evidence of financial stability, including most recent audited financial statements or equivalent documentation demonstrating organizational sustainability. | Demonstrated Financial Stability | Nice to Have | ||||
| SSE-38 | Vendor Reputation, Support Quality, and Ease of Use | Technical Account Management | Service Delivery Requirements | Provide access to a named Technical Account Manager (TAM) or equivalent dedicated support resource to assist with operational oversight and issue escalation. | Dedicated Technical Account Management | Desirable | ||||
| SSE-39 | Vendor Reputation, Support Quality, and Ease of Use | Training & Knowledge Transfer | Service Delivery Requirements | Provide structured training resources, including administrator training, documentation, knowledge base access, and optional certification paths. | Formal Training & Knowledge Enablement | Desirable | ||||
| SSE-40 | Vendor Reputation, Support Quality, and Ease of Use | Product Roadmap Transparency | Service Delivery Requirements | Provide visibility into the product roadmap, release cadence, and documented change management processes, including communication of major feature updates and security patches. | Transparent Product Roadmap & Release Cadence | Desirable | ||||
| SSE-41 | Vendor Reputation, Support Quality, and Ease of Use | Administrative Usability | User Functionality | Demonstrate a unified administrative console with intuitive policy configuration, role-based delegation, policy validation tools, and clear visibility into policy scope, dependencies, and impacted objects. The administrative experience shall allow administrators to review and modify policy or application scope without removing and recreating existing objects, and shall minimize operational complexity across large multi-tenant environments. | Intuitive Unified Management Interface | Desirable | ||||
| SSE-42 | Vendor Reputation, Support Quality, and Ease of Use | Documentation & API Clarity | User Functionality | Provide comprehensive, up-to-date technical documentation and API references to support integration, automation, and operational self-sufficiency. | Comprehensive Technical Documentation | Desirable | ||||
| SSE-43 | Technical and Functional Requirements | Government Cloud Parity | Technology Requirements | Provide equivalent administrative, reporting, automation, and policy-management capability in GCC or equivalent government cloud environments. Material functional differences between commercial and government deployments shall be identified in the vendor response and may be considered noncompliant where they affect operational use. | Government Cloud Feature Parity | Desirable |
File details come from the government source that posted it. Updated .