CB15-RFQ0003amend001_Security_Monitoring.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

1. CONTRACT ID CODE

2. AMENDMENT/MODIFICATION NO.

3. EFFECTIVE DATE

08/03/2015

4. REQUISITION/PURCHASE REQ. NO.

CB2015-0173

5. PROJECT NO. (If applicable)

AOCBOCODE

Acquisitions Office Congressional Budget Office 425B FHOB 2nd & D Streets, SW Acquisitions@cbo.gov Washington, DC 20515

6. ISSUED BY CODE7. ADMINISTERED BY (If other than Item 6)

9A. AMENDMENT OF SOLICITATION NO.

CB15-RFQ0003

CODE FACILITY CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, country, state and ZIP Code) (X)

X 9B. DATED (SEE ITEM 11)

07/17/2015

10A. MODIFICATION OF CONTRACT/ORDER NO.

10B. DATED (SEE ITEM 11)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X XThe above numbered solicitation is amended as set forth in item 14. The hour and date specified for receipt of Offers is extended, is not extended, Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods: (a) By completing items 8 and 15, and returning __1__copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment your desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT

ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return _______ copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitaiton/contract subject matter where feasible.)

This amendment 1) issues answers to questions submitted by potential offerors; and 2) extends the offer due date by 1 week, from August 7, 2015 to August 14, 2015.

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print) 16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

(Signature of person authorized to sign)

15B. CONTRACTOR/OFFEROR 15C. DATE SIGNED

By (Signature of Contracting Officer)

16B. UNITED STATES OF AMERICA 16C. DATE SIGNED

NSN 7540-01-152-8070

Previous edition unusable

STANDARD FORM 30 (REV. 10-83)

Prescribed by GSA FAR (48 CFR) 53.243

Document Type: Q4 Document Number: CB15-RFQ0003 Page 1 of 6

Amendment No. 001 to Solicitation # CB15-RFQ0003 Page 2 of 6

Questions and Answers for Cyber Security Monitoring Services Solicitation # CB15-RFQ0003

August 3, 2015

Solicitation Questions:

Question 1: Is there an incumbent currently performing this work?

Response: The posted RFQ is for similar work that is currently being performed by Foreground Security under Contract No. CB14-C0068.

Question 2: The RFQ states that “no adjustments are offered based on socio-economic categories or business size.” Does this mean CBO will not apply a HUBZone price evaluation preference if an offeror is a HUBZone Small Business Concern?

Response: That is correct.

Technical Questions:

Question 3: Are all CBO devices and data to be monitored/managed via this contract on unclassified systems?

Response: CBO machines that monitor email and web traffic are considered classified.

Question 4: How many users are within the CBO environment?

Response: Approximately 250.

Question 5: How many total IP addressed assets are within the scope of monitoring?

Response: 1,000 to 1,500.

Question 6: Of the total number of assets, how many are servers? How many are desktop-type devices? How many are network devices?

Response: 60 servers, 250 desktops.

Question 7: Does CBO currently utilize an IDS or IPS? If so, what vendor(s)/product(s)?

Response: See list of tools provided via the NDA.

Question 8: Does CBO currently utilize a SIEM? If so, what vendor(s)/product(s)?

Response: See list of tools provided via the NDA.

Question 9: Does CBO currently utilize a mail gateway filtering for malicious attachments or links? If so, what vendor(s)/product(s)?

Response: CBO currently uses a vendor for its email filtering service. We are expecting to transition to a new provider soon.

Question 10: Does CBO have any plans or projects underway to significantly alter the technology environment either by device count or architecture?

Response: The IT environment is expected to stay relatively unchanged for the foreseeable future.

Question 11: How many locations/sites are within scope for this RFQ?

Response: 3 (Active Site, DR Site and AWS environment).

Amendment No. 001 to Solicitation # CB15-RFQ0003 Page 3 of 6

Question 12: Are there any Novell implementations in use?

Response: No.

Question 13: What endpoint protection (e.g. antivirus) tool(s) are in use? Will they be replaced by the Contractor?

Response: See list of tools provided via the NDA. These tools will not be replaced by the Contractor.

Question 14: How many firewalls require monitoring? (Count High Availability clusters as one.)

Response: 1 cluster

Question 15: Which brand(s) and model(s) are they?

Response: See list of tools provided via the NDA.

Question 16: Are virtual firewalls being utilized on the managed / monitored firewalls?

Response: No.

Question 17: Where, geographically, are the firewalls deployed?

Response: DC metro area.

Question 18: How many STANDALONE firewalls or contexts listed above have the following number of live IP addresses behind them?

Response: N/A – no standalone firewalls.

Question 19: How many HIGH AVAILABILITY firewalls or contexts listed above have the following number of live IP addresses behind them? (Count each cluster as one.)

Response: 1 High Availability firewall with > 500 IP addresses.

Question 20: Would you like management services for these firewalls?

Response: See SOW ¶4 for requirements.

Question 21: If the firewalls are to be co-managed, which version(s) and platform(s) is/are the management console(s)?

Response: N/A

Question 22: Do you currently have any Web Application Firewalls (WAFs) deployed?

Response: No, but see SOW for AWS stateful and stateless firewalls.

Question 23: Is IDS deployed in this environment?

Response: Yes, as a separate device (not integrated in the firewall).

Question 24: How many IDS are deployed within each bandwidth range (count HA clusters as a single system)?

Response: 1 in the < 100 Mbit range.

Question 25: How many IDS are STANDALONE?

Response: N/A

Question 26: How many IS are HIGH AVAILABILITY (HA)?

Response: N/A

Question 27: Where, geographically, are the IDS devices deployed?

Response: DC metro area.

Amendment No. 001 to Solicitation # CB15-RFQ0003 Page 4 of 6

Question 28: Would you like the VSOC to provide management services for these IDS devices?

Response: See SOW ¶4 for requirements.

Question 29: Is an Intrusion Prevention System (IPS) deployed in this environment?

Response: Yes.

Question 30: How many IPS are deployed within each bandwidth range (count HA clusters as a single system)?

Response: 1 each in the < 100 Mbit range for the Active Site and DR Site.

Question 31: How many IPS are STANDALONE?

Response: N/A

Question 32: How many IPS are HIGH AVAILABILITY (HA)?

Response: N/A

Question 33: Would you like the VSOC to provide management services for these IPS devices?

Response: See SOW ¶4 for requirements.

Question 34: Where, geographically, are the IPS devices deployed?

Response: DC metro area.

Question 35: Please estimate the number of servers and network devices (routers, switches, VPN appliances, etc.) you want monitored (human analysis).

Response: 80+

Question 36: Please estimate the number of servers and network devices (routers, switches, VPN appliances, etc.) you want monitored with SIM on Demand (automated analysis).

Response: 80+

Question 37: Which kinds of COTS applications are you interested in monitoring? (Symantec Endpoint Protection, Microsoft Exchange, Microsoft SQL, etc.)

Response: This information can be provided to the successful Contractor after award.

Question 38: Are there any custom applications running which you would like monitored?

Response: This information can be provided to the successful Contractor after award.

Question 39: Can the developers of these [custom] applications provide us a list of possible log formats, so that we can build a set of filters?

Response: This information can be provided to the successful Contractor after award.

Question 40: Is raw log storage needed?

Response: No. CBO retains its own logs and VSOC staff shall review the logs on CBO systems.

Question 41: How many IP addresses would you like to scan?

Response: N/A – scanning is performed under a separate contract.

Question 42: Does the separate contract for Amazon Web Services Elastic Computer (AWS EC2) include security monitoring and managing services? If not, is there an incumbent performing those services now?

Response: The AWS contract does not include security monitoring or managed services.

Amendment No. 001 to Solicitation # CB15-RFQ0003 Page 5 of 6

Question 43: The RFQ states the offeror shall “procure” an Intrusion Detection System (IDS) and Security Log Monitoring system for use in the CBO’s AWS EC2 environment. Is it safe to assume CBO will permit the offeror to install the IDS and log monitoring system in AWS EC2 that are already implemented at the offeror’s facility for other clients? Or, does CBO want the offeror to assess the marketplace, propose a tool, obtain CBO approval, and then purchase the tool?

Response: The offeror shall propose a tool, then obtain CBO’s approval and purchase the tool under the contract.

Question 44: Can the government clarify which activity levels and the loads on what systems are they interested in reviewing to assess Offeror’s Background and Experience with Similar Projects?

Response: We will look at the offeror’s skillset and experience with the products CBO currently employs and marry that with their ability to understand the CBO infrastructure. We will look at the offeror’s experience with similar projects based on information provided in the offer. The threat feeds and the other systems that an offeror may have to view malware, anti-bots, etc. will be very helpful, but not the main avenue of assessment.

Question 45: Can the government clarify the inventory of systems that will be monitored and what is the expected growth of the inventory over the life of this contract?

Response: See the list of tools list provided via the NDA. This list includes current tools and what CBO plans to purchase in the near future. There is nothing else planned for purchasing at this time.

Question 46: Are you looking for the monitoring of security device events, management of security devices, or both in your environment?

Response: Both, in conjunction with the Contracting Officer’s Representative (COR).

Question 47: What would you like to accomplish through using a Managed Security Services Provider (MSSP)? Your overall expectations?

Response: Robust alerting and reporting, working with the COR.

Question 48: How many facilities do you own and/or operate? How many of them have IT Operations? How many are in scope?

Response: 2 (Active Site and DR Site). See also response to Question #11.

Question 49: Do you have outside 3rd party vendor hosted operations? Do they provide MSSP services for your organization?

Response: CBO uses third parties to host various functional services. Those vendors provide their own security services as applicable, under separate contracts.

Question 50: Is there a dedicated IT Security Manager/Coordinator? Is there one for each business unit that we’ll have to liaison with?

Response: The Contractor will liaison with the COR who is the IT Security Manager.

Question 51: Do you have an incident response plan in place?

Response: The plan will be fine-tuned with the Contractor and COR.

Question 52: Do you have a Security Plan or Policy in place?

Response: This information can be provided to the successful Contractor after award.

Question 53: What are your log retention requirements?

Response: See the response to Question #40.

Amendment No. 001 to Solicitation # CB15-RFQ0003 Page 6 of 6

Question 54: CBO has indicated that it currently has McAfee, Solera and Accelops SIEM solutions. Is CBO’s intention to replace these products with the Contractor solution?

Response: No.

Question 55: Attachment 1, Section 4 (d) states: “The Contractor’s team will work in conjunction with the COR to keep these systems online, patched, and up to date.” However, Section 1 of the same attachment states that the Contractor shall monitor agency cyber systems.

a) Please advise if the CBO is seeking monitoring only Managed Security Services solution or both monitoring and management where the Contractor is expected to make any necessary changes, patches, etc. to the CBO security devices (firewalls, IDS, application management tools, etc.)?

Response: The Contractor shall work in conjunction with the COR.

b) If CBO is seeking management services in addition to monitoring, is the expectation that all in scope security devices be managed 100% by the Contractor or management duties will be shared between the Contractor and CBO security personnel?

Response: Shared – Contractor shall alert the COR of changes needed and both parties work together to determine a timeline.

Question 56: Does the IDS deployment require both physically separate network IDS and/or a virtualized AWS host IDS?

Response: More than likely virtualized. This work will be done in conjunction with the AWS contractor.

Question 57: Does the Security Log Management solution also need to be part of the AWS EC2 system?

Response: Logs will need to be reviewed at the AWS location.

Question 58: What is the purchasing and procurement requirements / procedures for adding AWS services? Ex. (IDS, Log MGMT) Response: Contractor will work with the CBO engineer/COR and AWS contractor.

Question 59: What are the pay threat intelligence feed subscription requirements?

a) Exclusive to CBO usage?

Response: No.

b) Procured through CBO?

Response: No.

c) Does CBO access need to include a graphical web portal system (CIFv2/Alienvault/etc…)?

Response: No.