Attachment L14 - Revised Service Category 14 Response.docx

Digital Security Solutions RFP No. 24-43230000-RFP Revised Attachment L14 – Service Category 14: Cybersecurity Threat Intelligence (CTI)

Respondent Name: Respondent Name Goes Here Solution Name: Solution Name Goes Here

Respondent Instructions:

· Respondents shall use this Attachment as provided to respond. Altering character count limits or any other restriction or control may result in a Respondent being found non-responsive.

· Names. Respondents must provide their name and the proposed Solution name in the spaces above.

· Section 1 Prompts. Section 1 of this attachment provides prompts. The Respondent shall provide a response to prompt 1 and should provide a response to prompts 2 through 11. Prompts are indicated by red text followed by a response block.

Prompt 1 has a maximum of 3000 characters. Prompts 2 through 11 have a maximum character limit of 500. Respondents who submit responses outside of the maximum character limit may be deemed non-responsive. Any additional files, links, or other information provided outside the response block will not be considered for evaluation.

Scores will be assigned by each individual evaluator in accordance with Attachment C, Evaluation Criteria. Prompt 1 is worth a total of 5 points. Prompts 2 through 11 are worth a maximum of 4 points total. An individual Evaluator’s score of the technical response for a proposed Solution will be calculated by the following:

Evaluator’s Prompt 1 score + (Sum of the Evaluator Scores for Prompts 2-11 / 10) = Evaluator’s Technical Response Score.

· Section 2 Terms and Conditions. Section 2 of this attachment provides a space for the Respondent to include any Service Level Agreements (SLA) or additional terms and conditions that apply to the proposed Solution. Neither the SLAs nor the additional terms and conditions will be considered for evaluation.

· Definitions. Definitions contained in Attachment A, Statement of Work, are incorporated by reference.

Section 1. Prompts.

Prompt 1: Cybersecurity Threat Intelligence (CTI) Solutions must aggregate threat data from multiple sources, analyze it to uncover emerging threats, and provide actionable intelligence to enhance security defenses. The Solution should integrate with an organization’s existing security operations workflows, ensuring that threat intelligence is used to improve detection, prevention, and response efforts.

Please describe how Respondent’s proposed Solution meets the above prompt in the field below.

Prompt 1 Response Goes Here

For the portions that are prompts (indicated by red text followed by a response block), the Respondent should provide details on if and how the Solution meets the identified technical capabilities and features.

Prompt 2: Threat Data Aggregation – Solution should include open-source threat feeds, paid subscriptions, and proprietary sources. The platform should support integration with standards-based threat intelligence feeds such as STIX, TAXII, and others.

Please describe if and how Respondent’s proposed Solution meets the above prompt in the field below.

Prompt 2 Response Goes Here

Prompt 3: Threat Intelligence Platform (TIP) – Solution should consolidate and normalizes threat data, making it easy to share actionable intelligence with internal teams or external partners on a platform that has the capability to integrate with the CTI Solution. The platform should provide support for enrichment, scoring, and threat actor profiling.

Please describe if and how Respondent’s proposed Solution meets the above prompt in the field below.

Prompt 3 Response Goes Here

Prompt 4: Real-Time Threat Alerts – Solution should notify Customer designated security teams of emerging threats relevant to their environment, such as new vulnerabilities, malware campaigns, or attack techniques in real-time. Alerts should include contextual information such as indicators of compromise (IoCs), threat actor motivations, and recommended mitigations.

Please describe if and how Respondent’s proposed Solution meets the above prompt in the field below.

Prompt 4 Response Goes Here

Prompt 5: Custom Intel – Solution should include the ability to incorporate threat intelligence feeds and manual intelligence to include custom work/intel.

Please describe if and how Respondent’s proposed Solution meets the above prompt in the field below.

Prompt 5 Response Goes Here

Prompt 6: Customer Feeds – Solution should include the ability to potentially change feeds if needed to include, remove, or modify research, analysis, and intelligence feeds.

Please describe if and how Respondent’s proposed Solution meets the above prompt in the field below.

Prompt 6 Response Goes Here

Prompt 7: Integration with SIEM, SOAR, and SOC Tools – Solution should provide contextual threat intelligence directly within the security operations workflow. This integration should enable automated response actions such as blocking malicious IP addresses or adjusting firewall rules based on threat intelligence.

Please describe if and how Respondent’s proposed Solution meets the above prompt in the field below.

Prompt 7 Response Goes Here

Prompt 8: Feed Control – Solution should include Capabilities for incorporating premium feeds and manual intelligence.

Please describe if and how Respondent’s proposed Solution meets the above prompt in the field below.

Prompt 8 Response Goes Here

Prompt 9: Dynamic Threat Detection – Solution should include the ability to provide tailored threat intelligence focusing on specific threats relevant to an organization’s unique environment, including industry-specific and organization specific risks and potential adversaries, ensuring that security measures are aligned with real-world scenarios.

Please describe if and how Respondent’s proposed Solution meets the above prompt in the field below.

Prompt 9 Response Goes Here

Prompt 10: Threat Context – Solution should include the ability to provide contextual awareness threat intelligence, to include custom intelligence, that provides insights that consider the broader context of an organization’s operations, including user behavior, network architecture, and business priorities, allowing for more informed risk management.

Please describe if and how Respondent’s proposed Solution meets the above prompt in the field below.

Prompt 10 Response Goes Here Prompt 11: Threat Insights – Solution should include capability to provide actionable insights from custom intelligence offering clear recommendations for mitigation, response strategies, and risk prioritization, empowering an organization to make informed decisions and improve their security posture effectively.

Please describe if and how Respondent’s proposed Solution meets the above prompt in the field below.

Prompt 11 Response Goes Here

Section 2. Service Level Agreement or Additional Terms and Conditions.

Respondent shall include any Service Level Agreements (SLAs) or additional terms and conditions that apply to the proposed Solution in the following text boxes. The text boxes below have a maximum character limit of 32,672 characters each. The information provided in the text boxes below will not be scored but will be incorporated into the final Term Contract documents as an exhibit.

Any Applicable SLA Goes Here Any applicable Addtional Terms and Conditons Goes Here