CB18-RFP0008_Cyber_Security_Questions_&_Answers_vol3.pdf

Questions and Answers #3 for Cyber Security Monitoring Services Solicitation No. CB18-RFP0008

May 18, 2018

Question 1: Is there an alternate way we can send fingerprints to the US Capital Police for processing instead of traveling to DC to the Fingerprinting office?

Answer: Yes, there is a way to obtain fingerprints through a local police department for employees who are outside the DC area. Employees will not be required to travel to the US Capitol police location in DC. The Contractor shall coordinate with the CBO Security Manager after award to start the fingerprint process.

Question 2: In the Amended RFP released on 5/11/2018, in Question 12 the answer clearly states that the vendor will not be purchasing the SIEM, CBO will purchase the SIEM. However In the Q&A released on 5/17/2018, Question 2 answer states that “CBO expects offerors to recommend one or more SIEM acquisition solution in their respective proposals and include the associated firm fixed-price therefor.”

Clarification is needed on whether the CBO will hold the offeror responsible for pricing and providing the SIEM as part of this RFP as these answers seem contradictive of each other.

Answer:

• CBO will buy the SIEM.

• Vendors are being asked to recommend a SIEM (we are open to any platform

– disregard the Splunk reference in Q&A #1).

• Vendors are asked to provide the price of the SIEM on a rough order of magnitude for CBO to use in deciding on a SIEM. The price is not binding on the vendor.

• Vendors are NOT to include the cost of the SIEM in their price proposal for performing the security monitoring.

o A caveat to this is if a company is proposing a fully managed solution.

Then we would expect the cost of the SIEM to be included as a part of their overhead or operating costs.