CALNET_Managed_Security_Services_RFI.docx

REQUEST FOR INFORMATION

The California Network and Telecommunications (CALNET)

Table of Contents

Managed Security Services State of California Department of Technology Office of Statewide Technology Procurement September 5, 2024

The California Department of Technology CALNET Program is requesting information on cybersecurity solutions and services that align with the phases and initiatives outlined in the State of California’s Cyber Security Strategic Plan, also known as Cal-Secure, (The California Executive Branch’s five-year information security maturity roadmap).

The Cal-Secure document is located at the following URL:

https://cdt.ca.gov/wp-content/uploads/2021/10/Cybersecurity_Strategy_Plan_FINAL.pdf This is not a solicitation.

Purpose of the RFI The purpose of this Request for Information (RFI) is to gather comprehensive information on available cybersecurity offerings and capabilities that can enhance the security posture of California State Public organizations in accordance with the strategic priorities and phased implementation approach defined by Cal-Secure. The State’s objective is to gather detailed information about the solutions that can effectively address cybersecurity needs across various domains, including technology, processes, and people.

Background The State of California’s Cyber Security Strategic Plan highlights a phased order of priority for implementing cybersecurity capabilities to improve the overall security maturity of state entities. These phases are designed to ensure a structured and comprehensive approach to cybersecurity, addressing immediate needs while laying the groundwork for future advancements. We are interested in the following key areas:

1. Phase One: Foundational Capabilities

· Anti-Malware Protection

· Anti-Phishing Program

· Multi-Factor Authentication

· Continuous Vulnerability Management

· Asset Management

· Incident Response

· Continuous Patch Management

· Privileged Access Management

· Security and Privacy Awareness Training

2. Phase Two: Advanced Monitoring and Response

· Security Continuous Monitoring (24x7)

· Cloud Security Monitoring

· Data Loss Prevention

· Log Management

· Network Threat Detection and Protection

· Threat Intelligence Platform

3. Phase Three: Application and Operational Technology Security

· Application Security

· Operational Technology Security

· Disaster Recovery

4. Phase Four: Identity and Access Management

· Identity Lifecycle Management

· Enterprise Sign-On

· Mobile Device Management

· Application Whitelisting

5. Phase Five: Emerging Capabilities

· Software Supply Chain Management

· Insider Threat Detection

· Network Access Control

· Enterprise Encryption

· Mobile Threat Defense

6. Administrative and Oversight Capabilities

· Administrative Functions

· Billing & Invoicing

· Oversight

· Reporting

· Other Items Requested Information The CALNET Program is requesting that you provide detailed information on your solutions and services within the Managed Security Services RFI Workbook or by providing additional attachments, including but not limited to:

· Solution Overview: Description of the solution, key features, and functionalities.

· Alignment with the Cal-Secure Strategic Plan Phased Approach: Explanation of how your solution aligns with the five different phases and priorities outlined in Cal-Secure Strategic Plan.

· Implementation and Integration: Information on implementation timelines, integration capabilities, and required resources.

· Case Studies and References: Examples of successful implementations and references from similar organizations.

Please refrain from providing traditional “Marketing Materials”. The State is requesting detailed responses to the components listed for each identified managed security solution. Concerns, restrictions, limitations, and suggested modifications will help the State in developing requirements for possible future statewide managed security solution contracting opportunities.

Contact

Questions The State will accept e-mail inquiries only to the Contact above. Questions must be received no later than the date specified in Key Action Dates. The State may contact an inquirer to seek clarification of any inquiry or response received.

Submission Process Please submit your completed workbook responses electronically to the Office of Statewide Technology Procurement (OSTP) Officer, Armit Dhillon amrit.dhillon@state.ca.gov (listed above) by November 8, 2024, at 10:00 am, Pacific Standard Time (PST).

We appreciate your time and effort in providing the requested information and look forward to exploring potential collaborations that will enhance our cybersecurity capabilities in line with the State of California's strategic vision.

Key Action Dates

Addenda Changes may be made to this RFI and will be done via Addenda that will be posted in Cal eProcure.

Attachments There are two (2) attachments to this RFI:

1. Attachment A – CALNET Managed Security Services RFI Workbook

2. Attachment B – Cal-Secure Cybersecurity Strategic Plan RFI Disclaimer This RFI is issued for information and planning purposes only, and it does not constitute a solicitation. Responses to the RFI will not be returned. A response to this RFI is not an offer and cannot be accepted by the California Department of Technology CALNET Program to form a binding contract. This RFI is solely designed to provide California Department of Technology CALNET Program with meaningful information to enable the California Department of Technology CALNET Program to determine how to proceed with its activities.

Vendors are solely responsible for all expenses associated with responding to this RFI. The State is not responsible for any expenses associated with responding to this RFI.

The submission of a response does not constitute any commitment on the part of the interested party. However, the Vendor agrees that the submitted information is correct to the best of the Vendor’s knowledge. Also, the right to compete in future procurements is not affected in the event that the party chooses not to submit a response to this RFI. The California Department of Technology CALNET Program is also interested in learning the reasons for not submitting a response.

Vendors are advised that all documents submitted in response to this RFI will become the property of the State of California, and will be regarded as public records under the California Public Records Act (CPRA) pursuant to Government Code Section 6250 et seq. and subject to review by the public. The intent of this RFI is to validate project objectives and requirements for possible future solicitations. Please do not include any confidential or proprietary information in responses to this RFI as it may be disclosed or be subject to the CPRA.

Note: The intent of this RFI is solely for information and planning purposes and does not constitute a solicitation. Therefore, do not include any proprietary or confidential information in your response to this RFI.

Page 1 | 1 image1.png image2.png image3.png image4.png image5.png