Attachment L4 - Service Category 4 Response.docx

Digital Security Solutions RFP No. 24-43230000-RFP Attachment L4 – Service Category 4: External-Facing Asset Discovery

Respondent Name: Respondent Name Goes Here Solution Name: Solution Name Goes Here

Respondent Instructions:

· Respondents shall use this Attachment as provided to respond. Altering character count limits or any other restriction or control may result in a Respondent being found non-responsive.

· Names. Respondents must provide their name and the proposed Solution name in the spaces above.

· Section 1 Prompts. Section 1 of this attachment provides prompts. The Respondent shall provide a response to prompt 1 and should provide responses to prompts 2 through 8. Prompts are indicated by red text followed by a response block.

Prompt 1 has a maximum of 3000 characters. Prompts 2 through 8 have a maximum character limit of 500. Respondents who submit responses outside of the maximum character limit may be deemed non-responsive. Any additional files, links, or other information provided outside the response block will not be considered for evaluation.

Scores will be assigned by each individual evaluator in accordance with Attachment C, Evaluation Criteria. Prompt 1 is worth a total of 5 points. Prompts 2 through 8 are worth a maximum of 4 points total. An individual Evaluator’s score of the technical response for a proposed Solution will be calculated by the following:

Evaluator’s Prompt 1 score + (Sum of the Evaluator’s Scores for Prompts 2-8 / 7) = Total Solution Evaluator’s Technical Response Score

· Section 2 Terms and Conditions. Section 2 of this attachment provides a space for the Respondent to include any Service Level Agreements (SLA) or additional terms and conditions that apply to the proposed Solution. Neither the SLAs nor the additional terms and conditions will be considered for evaluation.

· Definitions. Definitions contained in Attachment A, Statement of Work, are incorporated by reference.

Section 1. Prompts.

Prompt 1: External-Facing Asset Discovery Solutions must help organizations identify and assess the security of their publicly accessible digital assets, such as web servers, cloud services, applications, and other internet-facing systems. The Solution must continuously scan the organization’s external IP ranges and domains to identify assets that are exposed to the internet and assess their vulnerabilities.

Please describe how Respondent’s proposed Solution meets the above prompt in the field below.

Prompt 1 Response Goes Here

For the prompts below (indicated by red text followed by a response block), the Respondent should provide details on if and how the Solution meets the identified technical capabilities and features.

Prompt 2: Contiuous Scanning – Solution should provide continuous scanning of public IP addresses and domains associated with the organization, identifying all internet-facing services, applications, and network devices.

Please describe if and how Respondent’s proposed Solution meets the above prompt in the field below.

Prompt 2 Response Goes Here

Prompt 3: Service Detection and Banner Grabbing – Solution should collect information such as service versions, SSL/TLS certificate details, and software configurations for each exposed asset.

Please describe if and how Respondent’s proposed Solution meets the above prompt in the field below.

Prompt 3 Response Goes Here

Prompt 4: Identification of Outdated Software – Solution should identify outdated software or insecure configurations, such as weak SSL certificates, open ports, misconfigured DNS settings, or vulnerable software versions that could be exploited by attackers.

Please describe if and how Respondent’s proposed Solution meets the above prompt in the field below.

Prompt 4 Response Goes Here

Prompt 5: Integration with Vulnerability Databases – Solution should integrate with vulnerability databases such as CVE, CWE, and the National Vulnerability Database to provide immediate context around known vulnerabilities affecting identified services or software.

Please describe if and how Respondent’s proposed Solution meets the above prompt in the field below.

Prompt 5 Response Goes Here

Prompt 6: Risk Scoring – Solution should accommodate risk scoring of external assets, prioritizing those that are most vulnerable to exploitation or are most critical to business operations.

Please describe if and how Respondent’s proposed Solution meets the above prompt in the field below.

Prompt 6 Response Goes Here

Prompt 7: Customizable Alerting – Solution should notify security teams when a new external asset is detected, a known vulnerability is identified, or a change in configuration occurs (e.g., a certificate has expired).

Please describe if and how Respondent’s proposed Solution meets the above prompt in the field below.

Prompt 7 Response Goes Here

Prompt 8: Integration of CTI Data Feeds – Solution should correlate external-facing assets with current threat actor campaigns or vulnerabilities that are actively being exploited. This ensures that publicly exposed services are continuously monitored against known threats in real-time.

Please describe if and how Respondent’s proposed Solution meets the above prompt in the field below.

Prompt 8 Response Goes Here Section 2. Service Level Agreement or Additional Terms and Conditions.

Respondent shall include any Service Level Agreements (SLAs) or additional terms and conditions that apply to the proposed Solution in the following text boxes. The text boxes below have a maximum character limit of 32,672 characters each. The information provided in the text boxes below will not be scored but will be incorporated into the final Term Contract documents as an exhibit.

Any Applicable SLA Goes Here Any applicable Addtional Terms and Conditons Goes Here