Attachment J.2 Requirements Questionnaire Cyber Range.xlsx
XLSX spreadsheet 41 KB Posted
- Attached to
- Cyber Range for Training for the AO
- Solicitation number
- USCA25Q0053
- Issued by
-
Administrative Office of the U.S. Courts
About this file
This document is an Attachment J.2 Requirements Questionnaire for a Cyber Range procurement by the Administrative Office of the United States Courts (AO). The questionnaire details comprehensive requirements for a virtual cyber range platform to support cybersecurity training for approximately 1,000 IT professionals within the Federal Court community. Key technical requirements include the ability to conduct live, virtual training events with customizable environments, support for multiple cybersecurity tools (such as Qualys, Ivanti, Splunk, and Palo Alto), multi-cloud support, and concurrent lab scenarios.
The questionnaire covers five primary capability areas: Cyber Range Environment, Customization, Security/Compliance/Architecture, General Capabilities, and Integration/Platform Capabilities. Critical compliance requirements include meeting FEDRAMP moderate security controls, supporting modern authentication standards, implementing role-based access control, ensuring data encryption in transit and at rest, and providing comprehensive security features like incident response procedures, data privacy protections, and disaster recovery capabilities. Vendors must complete the questionnaire by answering each highlighted cell with a yes/no response and providing detailed explanations to demonstrate how their solution meets each specified requirement.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Cyber Range USCA25Q0053 Q and A.xlsx | XLSX spreadsheet | |
| USCA25Q0053 0004.pdf | ||
| Attachment J.1 Required Capabilities Document Amnd 0004.pdf | ||
| USCA25Q0053 Amnd 0003.pdf | ||
| USCA25Q0053 Amnd 0002.pdf | ||
| 8USCA25Q0053 Amnd 0001.pdf | ||
| USCA25Q0053.pdf | ||
| Attachment J.1 Required Capabilities Document.pdf | ||
| Attachment J.3 Pricing Sheet.xlsx | XLSX spreadsheet |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions to the Vendor
| Instructions for Completion of the Questionnaire |
| Vendors should fill in all of the highlighted cells in the Questionnaire tab of this workbook by answering each question in column D of the Questionnaire tab with a yes or no answer. The vendor then needs to explain their answer in column E of the Questionnaire tab. It is up to each offeror to provide enough information in Column E to support your answer in Column D of that tab. Failing to provide sufficient information may result in your solution being considered technically unacceptable. Failing to fill in all of the highlighted cells may result in your solution being considered technically unacceptable. |
Notes to the Vendor:
When providing responses, the guide below should be followed. The comments column is provided for clarification when necessary.
For functionality that requires a customization or work around, please provide details on the customization/work around to include if it is a technical or busniess customization/workaround.
For functionality that is priovided by a third-party vendor, please include a copy of the agreement language you have with the third-party.
Vendors are cautioned not to indicate functionality as "included in standard offering" when, in fact, that particular function is in development. If this is the case, then vendors should note this fact in the comments column and indicate the expected date such features will be made available.
Vendors are advised not to just repeat the requirements in Column E but rather explain how their solution meets the requirement. Additional information can be added to the technical supplement document noted in the solicitation.
Questionnaire
| Cyber Range Environment | ||||
| Feature # | Use Cases | |||
| Criterion | Description | Solution meets the Requirement | Vendor Response (Explains how their solution meets the requirement.) | |
| 1 | Cyber Range Environment | The cyber range should allow for trainers to conduct live, virtual training events with congruent operating models supporting custom hands-on training on cybersecurity tools. The operating models need to include accurate, simulated court network environments for realistic training events. Please see example training course provided in J.1 |
| Capabilities | ||||
| Criterion | Description | Solution meets the Requirement | Vendor Response (Explains how their solution meets the requirement.) | |
| 2 | Customization | Ability to provide an environment which can be customized on demand to match intel-driven requirements | ||
| 2.1 | Incorporate cyber tools | Ability to incorporate independent cyber tools into the cyber environment for cyber professionals to respond to/engage with various threat scenarios, including but not limited to: | 0 | |
| 2.2 | Can incorporate Qualys with the following sub-capabilities | Qualys: Asset Management, Vulnerability and Configuration Management, Risk Remediation, Threat Detection and Response, Compliance, Cloud Security | ||
| 2.2.1 | o Endpoint, Detection and Response (EDR) | |||
| 2.2.2 | o Vulnerability Management, Detection and Response (VMDR) | |||
| 2.2.3 | o Patch Management (PM) | |||
| 2.2.4 | o Cybersecurity Asset Management (CSAM) | |||
| 2.2.5 | o Custom Assessment and Remediation (CAR) | |||
| 2.2.6 | o Policy Audit (PA) (formerly Policy Compliance) | |||
| 2.3 | Can incorporate Ivanti with the following sub-capabilities | Ivanti | ||
| 2.3.1 | o Ivanti Neurons Secure UEM (Unified Endpoint Management) Professional | |||
| 2.3.2 | o Ivanti Neurons for Patch Management Cloud Subscription | |||
| 2.4 | Can incorporate Splunk with the following capabilities | Splunk version 9.2.5 | ||
| 2.5 | Can incorporate Pal Alto with the following capabilities | Palo Alto 3020 firewalls | ||
| 2.6 | Concurent Labs | Capability to have concurrent range scenarios and/or labs running at any given time | ||
| 2.7 | 24/7 access | Allows participants on-premises and remote to access any given scenario and labs simultaneously | ||
| 2.8 | Multi-Cloud Support | Support for across multiple cloud providers (e.g., AWS, Azure, GCP) and hybrid environments. | ||
| 2.9 | User-Friendly Interface | Intuitive dashboard and reporting features for ease of use and quick insights. | ||
| 2.10 | Generate multiple environments | Ability to generate multiple environments to support different scenarios and different users | ||
| 2.11 | Mission design | Ability for mission planners/white teams to design and execute missions with an intuitive graphical user interface, record/playback scenarios, and export time-sequenced scenario data for further analysis | ||
| 2.12 | Collaboration Tools | Features that enable teams to collaborate effectively on governance activities and incident management. | ||
| 2.13 | Replicate and employ threats at scale. | Ability to replicate and employ threats at scale either pre-planned or in real-time | ||
| 2.14 | Support congruent operating models | Ability to support congruent operating models supporting blue and red representations simultaneously for large-scale and team/mission-focused scenarios | ||
| 2.15 | Pre-packaged content | Ability to purchase or subscribe to pre-packaged content ready to be integrated into curriculum for key cybersecurity topics including, but not limited to, cryptography, network security, computer security, software security, offensive security, defensive security, digital forensics on network traffic and digital devices, and incident response. | ||
| 2.16 | Training events | Training events should support up to 25 students at the same time, with the ability to rotate to a different group of students each month |
| Security, Compliance, Architecture | ||||
| Criterion | Description | Solution meets the Requirement | Vendor Response (Explains how their solution meets the requirement.) | |
| 3 | Compliance with federal security guidelines | Vendor meets all FEDRAMP moderate security controls. (Vendor must provide information on how they meet FEDRAMP moderate security controls. Ex: FEDRAMP Authorized, FEDRAMP Ready, Third Party Assessments.) | ||
| 3.1 | Security level | The administrative security is provided down to a table/field level. | ||
| 3.2 | User authentication | The vendors product must support standards based modern authentication to the Judiciary's IDP. (OIDC, SAML2, also addressed in Attachment b. | ||
| 3.3 | Role-based security | Role-based access control (RBAC)for admins and end user roles is supported. | ||
| 3.4 | Data transmission and storage | Data is secured during transmission | ||
| 3.5 | Data encryption | Encryption is provided both in transit and at rest. | ||
| 3.6 | Password encryption | Passwords are encrypted. Please describe the password policy. | ||
| 3.7 | Password policy | User password change requirements are supported and are configurable by compensation administrators. | ||
| 3.8 | Ability to support Firefox 52.x or higher | Firefox is supported. | ||
| 3.9 | Ability to support Chrome 63.x or higher | Chrome is supported. | ||
| 3.10 | Ability to support Microsoft Edge Version 108.0.1462.54 or higher | Microsoft Edge is supported. | ||
| 3.11 | Ability to support Safari 10.x or higher | Safari is supported. | ||
| 3.12 | Cloud VPN Support | Cloud VPN is supported. The current implemtation is through Zscaler. | ||
| 3.13 | Zero footprint (excluding browser plug in) | No software or data requirements for client access beyond a browser. | ||
| 3.14 | Maintenance windows | A standard maintenance window and schedule are provided. | ||
| 3.15 | Data privacy | Data privacy is ensured. Provide documentation explaining how the vendor handles data. | ||
| 3.16 | Data rights | In the event that the AO decides to transition to a different solution, the AO is able to retrieve its data. | ||
| 3.17 | Data separation | Data is separated and secured from other tenants. | ||
| 3.18 | Data protection | Data is protected from other users on the same (cloud) server (if shared). | ||
| 3.19 | Data access | Access to the AO's data is limited. | ||
| 3.20 | Incident procedures | There are security and operational incident response procedures. | ||
| 3.21 | Incident notification | Vendor will notify the AO of security incidents. Please describe the response time and notification procedure in the Comments section. | ||
| 3.22 | Incident reports | Post-incident/root cause analysis reports will be provided. | ||
| 3.23 | Incident SLA | Vendor provides an SLA on incident handling notifications. | ||
| 3.24 | Data destruction on termination | Data will be destroyed if agreement is terminated. | ||
| 3.25 | Private and sensitive information | The export of private and sensitive information is limited. | ||
| 3.26 | Information security policy | Vendor has an information security policy. | ||
| 3.27 | Vendor assessments | Vendor assessments are performed by a third party. | ||
| 3.28 | Vendor assessment reports | Reports produced as part of such assessments can be reviewed by our organization. | ||
| 3.29 | Security audit | Our organization is able to periodically audit the vendor's security practices. | ||
| 3.30 | Audit results for the past two years | Vendor is willing to share the external audit results for the last two years. | ||
| 3.31 | Disaster recovery | There is a separate disaster recovery site. | ||
| 3.32 | Backups and encryption | Backups are encrypted and routinely tested. | ||
| 3.33 | Hosting Service | Vendor uses tier 1 services such as AWS. List providers used for hosting infrastrucutre services, authentication, application monitoring and Content Delivery Network (CDN) |
| General Capabilities | ||||
| Criterion | Description | Solution meets the Requirement | Vendor Response (Explains how their solution meets the requirement.) | |
| 4 | End user UI ease of navigation | Supports ease of use features for both end users, content curators and administrators of the platform. | ||
| 4.1 | Ease of administration and structure, governance | Information is structured and governed within the platform. | ||
| 4.2 | User community | Online community for support and ideas for all vendor customers. | ||
| 4.3 | User feedback | Ability for users to post feedback on materials. This can include ratings but is meant to determine more specific feedback via written form. | ||
| 4.4 | Change management | Administrative training for management of solution including reporting and analysis is provided. | ||
| 4.5 | Customer support | Support is provided 24/7 and is included in the subscription costs. A designated POC is provided. | ||
| 4.6 | Data storage | Unlimited data storage is provided. | ||
| 4.7 | Scalable architecture | The proposed solution architecture scales (users,roles, business units, geographies, etc.). | ||
| 4.8 | Business continuity | Business continuity plans and policies are provided. | ||
| 4.9 | Solution is low/no code | The proposed Cyber Range is low/no code for content builders (back end resources) | ||
| 4.10 | Solution is role based | Solution provides diferent administrative and end user roles and there is no limit to the number of roles that can be configured. List role access. | ||
| 4.11 | Compliance for people with disabilities | The platform supports people with disabilities, confirming to acts like the Americans with Disabilitis act. |
| Integration and Platform Capabilities | ||||
| Criterion | Description | Solution meets the Requirement | Vendor Response (Explains how their solution meets the requirement.) | |
| 5.1 | SSO/SAML integration | Supports SSO/SAML integration. | ||
| 5.2 | LDAP integration | Supports LDAP integration. | ||
| 5.3 | Integration to portals | Supports integration to portals | ||
| 5.4 | Integrations and APIs | Supports open API integration to other systems. Please list any that are provided out of the box in the comments column | ||
| 5.5 | CI/CD | Incorporate the judiciary continuous integration and continuous deployment (CI/CD) pipeline. |
| Implementation, Configuration, Kick-off support | ||||
| Criterion | Description | Solution meets the Requirement | Vendor Response (Explains how their solution meets the requirement.) | |
| 6.1 | Training | Vendor provided training for Training Division staff IAW the J.1 Requirements Capabailities | ||
| 6.2 | Set-up, configuration, and deployment | Vendor must include setup, configuration, and deployment support to assist with training and rapid deployment of the product during the base year only. IAW the J.1 Requirements Capabailities |
File details come from the government source that posted it. Updated .