CB13-RFQ0001_Cyber_Monitoring_QAs.pdf

Questions and Answers for Cyber Security Monitoring Services Solicitation # CB13-RFQ0001

September 3, 2013

Question 1: Is there an incumbent for this opportunity?

Response: This is a new requirement for CBO, so there is no incumbent.

Question 2: Would you consider setting aside this opportunity for Small Business?

Response: As a Legislative Branch agency, CBO is not required to follow the Executive Branch socioeconomic program [Ref. RFQ §4, “Notice of Full and Open Competition”]. We do not have any set-asides, but we do encourage small businesses of all types to submit responses to our solicitations.

Question 3: What is the anticipated level of effort in terms of Full Time Equivalent(s) (FTE)?

Response: We do not anticipate a specific number of FTEs for this requirement, but rather a team of people already working in a Virtual SOC that can monitor during the hours specified.

Question 4: Where is the primary work location?

Response: Off-site at a Contractor facility (see SOW ¶3.2.1: Monitoring via a VPN connection).

Question 5: The RFQ specifies that the contractor must possess a Facility Clearance; is a Top Secret facility clearance required?

Response: A facility clearance is preferred but not required. In this case, the RFQ states the company "should" have a facility clearance (not "must" or "shall").

Question 6: If a TS facility clearance is not required, what is the level of facility clearance that is required?

Response: See also the answer to Question 5 above. A clearance of any level is preferred but not required.

Question 7: Does the Government require contractor staff to possess a clearance in order to complete the work described in the SOW?

Response: See SOW ¶3.2.8: CBO must have access to at least one analyst cleared at the Top Secret (TS) level. See also the Response to Question 17.

Question 8: Can CBO provide details on what technology CBO is using for their:

• Security Event Information Manager (SIEM)?

• Full Packet Capture System?

• Data Loss System?

• Firewalls

• Intrusion Prevention Systems?

• Memory Capture Systems?

Response: Details will be provided by email to individual companies upon request, subject to nondisclosure agreement.

Question 9: Please provide more detail on what type of software upgrades and maintenance activities will be required for out of line systems. Security patches? All software upgrades?

Response: See Response to Question 16.

Question 10: Please provide more detail on where the 50 threat feeds are coming from and how those feeds are provisioned. Are threat feeds from devices on the CBO network? Or is threat feed meant to be information about potential threats from other sources? If the threat feeds are from devices on the network, are the threat feeds directed to the SIEM or monitored separately?

Response: See Response to Question 12.

Question 11: Can CBO provide a list of security certifications required for the Security Engineers and what CBO products the Security Engineers are expected to have experience with?

Response: See Response to Question 8.

Question 12: In reference to SOW ¶3.2.5 (“Provide a minimum of 50 threat feeds…”), what type of threat feeds is this referring to? (general threat? network or system threat? vendor product list?)

Response: The Contractor must subscribe to at least 50 threat feeds that provide intelligence for cyber response and analytical work. These feeds should be a mixture of free and paid for services. These feeds should contain malicious links, email addresses, domain names, IP addresses, and MD5 Hashes. They must be a mixture of network threat, cyber threat, and system threats.

Question 13: Will the government provide GFE (laptop, server, monitor, …..) for the contractor to provide cyber monitoring and engineering services?

Response: No GFE will be provided. The services shall be performed off-site via a VPN connection from a Contractor facility (see SOW ¶3.2.1: Monitoring via a VPN connection).

Question 14: Will a list of CBO Cyber related products be available prior to the proposal due date so the contractor can more accurately assign the proper resources who “…are certified in up to 3 CBO cyber security products”?

Response: See Response to Question 8.

Question 15: Is this solicitation designed to acquire a resource for after hours, weekend and holiday monitoring as an augmentation of existing staff? Or, is this a person to augment the staff during normal business hours AND nights, weekends and holidays?

Response: The Contractor shall provide a person or team of people to provide monitoring during non-business hours (6pm-6am and 24 hours a day on weekends and holidays) [see SOW ¶3.2.2]. CBO staff are performing monitoring services during business hours (6am-6pm).

Question 16: What systems specifically will be “maintenance and upgrades to out of line systems”? Is this Managed Services?

Response: This is not managed services, but systems that do security monitoring that are not inline with network connectivity. These systems need to be updated with patches periodically as well as updating threat lists on these devices.

Question 17: If the individual is TS cleared, will a TS level clearance be required for VPN work?

Response: No. CBO must have access to at least one analyst cleared at the TS level [see SOW ¶3.2.8], but VPN staff do not need TS clearance.

Question 18: During Security Monitoring, what are the actions required if alerts occur after hours – are these procedures documented and will the contractor have to execute them or only notify CBO personnel?

Response: CBO would determine classifications of alerts and instruct the Contractor how to proceed with them.