CB18-RFP0008_Cyber_Security_Questions_&_Answers_vol2.pdf

Questions and Answers #2 for Cyber Security Monitoring Services Solicitation No. CB18-RFP0008

May 17, 2018

Question 1: Ref. Amendment 2, Answer to Question #12 and #28. CBO has implied that it is currently using Splunk for its SIEM, and has stated it intends to acquire a new SIEM through a separate mechanism. Will this new SIEM be acquired, and architecture disclosed, prior to the start of this work? If not, will the awardee be expected to maintain the current SIEM (Splunk?) and then support the acquisition and evaluation process, and transition to the new SIEM? Or does CBO intend to change the contract type to a “Time and Materials” or “Cost-Plus” model?

Answer: CBO is not currently using SPLUNK for enterprise security monitoring. CBO is soliciting recommendations from vendors for both a CBO-owned SIEM platform or a vendor-owned SIEM platform. CBO plans to involve the awardee in the acquisition or onboarding process for either option it decides to pursue. If CBO opts to acquire its own SIEM in parallel with this award, the awardee will not be responsible for maintaining the acquired SIEM.

Question 2: Ref. Amendment 2, Answer to Question #12 and Section 3(1). CBO has stated that it intends to acquire a new SIEM through a separate mechanism, but that the contractor is responsible for supporting “one or all of the following log management solutions,” and includes all 4 co-location models. Each of the four

(4) models have a different scope/scale and associated pricing. Should bidders price each of the four (4) potential co-location models? Or does CBO intend to change the contract type to a “Time and Materials” or “Cost-Plus” model?

Answer: CBO is exploring and soliciting recommendations related to all four log management solutions listed in the RFQ at Part 3, Document 1 – SOW, ¶3(1).

CBO has not made a decision to acquire a new SIEM nor have we developed a preference for either SIEM solution. CBO expects offerors to recommend one or more SIEM acquisition solution in their respective proposals and include the associated firm fixed-price therefor. (See also Question #5)

Question 3: Ref. Amendment 2, Answer to Question #12. CBO has indicated that it will separately acquire a SIEM. What scope should bidders use to price their proposal? Should it be for services only and exclude a new SIEM and event/flow collectors and other collection devices?

Answer: CBO does not plan to acquire a SIEM prior to this award. As stated in the RFQ, CBO is exploring all SIEM acquisition options and will evaluate proposed solutions and decide on a suitable solution based on proposals per the RFQ requirements. A proposal may include a recommendation to acquire a new SIEM that the offeror supports and/or a recommendation to provide CBO with a fully-managed SIEM solution that the offeror owns and supports. CBO will objectively evaluate either option without prior preference for any solution. CBO is open to any SIEM solution recommended by the offeror.

Question 4: Ref. Amendment 2, Answer to Question #12. Is CBO open to alternate pricing that includes a SIEM and collectors?

Answer: Yes, CBO is open to that alternative.

Solicitation No. CB18-RFP0008 Page 2 Questions and Answers #2

Question 5: Will CBO accept alternate proposals? If so, can these be provided in the same proposal, or do multiple proposals have to be submitted for each?

Answer: Yes, CBO will accept alternate proposals. (See RFQ Part 4, ¶3(e) of provision CBO 212-01, Instructions to Offerors – Commercial Items.) Multiple solution recommendations may be included in the same proposal provided the related pricing for each solution is clearly delineated.

Question 6: Is there an alternate way we can send fingerprints to the US Capital Police for processing instead of traveling to DC to the Fingerprinting office?

Answer: We are investigating whether there is an alternative to the DC location and will post that information at FBO.gov prior to the proposal due date.