The file's text, extracted by GovTribe without its formatting.
CIP ENTERPRISE SECURITY AWARENESS TRAINING
RFP 260000001298 State Answers to Bidder Questions
| Q # |
| Document and Section |
| Page # |
| Bidder Question |
| State's Answer |
| 1 |
| Statement of Work |
| 64 |
| Who are you currently using for Security Awareness Training? |
| Current contract information can be found here: https://www.michigan.gov/dtmb/procurement/contractconnect/contract-list |
| 2 |
| Statement of Work |
| 64 |
| Is there interest in consolidating vendors? And quoting more than just the Security Awareness Training? |
| At this time, please submit a proposal based strictly on the items and specifications listed in the bid requirements. |
| 3 |
| Schedule E Data Security Requirements |
| 102 |
| Is the expectation that the ESAT is FedRamp compliant? |
| See Schedule E - Data Security Requirements |
| 4 |
| Schedule A – Statement of Work, Section 3 Purpose |
| 65 |
| Can the State provide current baseline metrics used to assess the effectiveness of its phishing simulation and security awareness program (e.g., click rates, report rates, repeat susceptibility), along with any defined target outcomes for improvement? |
| The State tracks metrics such as emails delivered, opened, clicked, scanned, attachments opened, and reported. |
Target outcomes and improvement goals are determined by individual agencies based on their specific needs.
| 5 |
| Schedule A – Statement of Work, Section 3 Purpose |
| 65 |
| The RFP emphasizes assessing training effectiveness and using measurable results to focus targeted training efforts. |
Can the State identify the primary behavioral or security gaps it is seeking to improve in the next contract term (e.g., credential harvesting susceptibility, MFA bypass behaviors, reporting rates, or response times)?
Training effectiveness and the use of measurable results are largely agency-specific. Individual agencies determine targeted training needs, while the Security Team helps guide priorities based on current threats and vulnerabilities.
| 6 |
| Schedule A – Statement of Work, Section 3 Purpose |
| 65 |
| To better understand how the State currently optimizes its training curriculum for effectiveness and user engagement, can the State share which courses or content types are actively deployed today (e.g., core training, microlearning, simulations), and whether a list of currently utilized courses can be provided? |
| The State addresses a broad set of security awareness topics and adjusts focus based on current and emerging threats. Key areas include phishing and social engineering, email security, passwords and authentication, data protection, malware and ransomware, incident reporting, and physical security. |
Additional topics include AI-related risks, mobile device security, remote work, and internet use. The State also works closely with internal security partners to identify threats and vulnerabilities, which helps guide training priorities.
| 7 |
| Schedule A – Statement of Work, Section 3 Purpose |
| 65 |
| Can the State provide the current average time-to-report for simulated phishing emails across the enterprise, and whether improving reporting speed is a defined objective for the program? |
| The state does not monitor reporting speed currently. |
| 8 |
| Schedule A – Statement of Work, Section 2 Background |
| 64 |
| Given the emphasis on role-based training aligned to NIST guidance, are there identified compliance or coverage gaps in the State’s current program (e.g., for privileged users, developers, or contractors) that the new solution is expected to address? |
| This isn't exhaustive but we are interested in training related to Security Administrators; System Administrators, IT related positions (Data Custodians, Programmers, etc.) and Database Administration. |
| 9 |
| Schedule A – Statement of Work, Section 3 Purpose |
| 65 |
| Can the State provide historical data on the percentage of users who have repeatedly failed phishing simulations (e.g., multiple consecutive failures) over the past 12 months, and whether reducing repeat susceptibility is a defined objective for the program? |
| The State currently conducts one six month long enterprise-wide phishing campaign annually. In addition, individual agencies may conduct smaller, targeted campaigns on a quarterly or as-needed basis. |
At this time, repeat failure trends are not tracked as a formal statewide metric across campaigns. However, phishing simulation results are used to inform training efforts and reinforce awareness at both the enterprise and agency level.
| 10 |
| Schedule A – Attachment 1 – Business Specification Worksheet, Item 10.0 |
| 83 |
| To what extent has the current training curriculum been customized to incorporate State of Michigan-specific policies (e.g., DTMB 1340.00), local terminology, and internal reporting procedures, and is expanding this level of customization a priority for the next contract term? |
| The State customizes training content as needed to incorporate State-specific policies, terminology, and internal procedures. Prebuilt vendor content is used as a foundation, with adjustments made when additional context or clarification is required. |
Expanding this level of customization may be considered in the next contract term to support continued relevance and effectiveness.
| 11 |
| Schedule A – Statement of Work, Section 3 Purpose |
| 65 |
| To support realistic phishing simulation scenarios, does the State currently utilize internally themed templates, and are these templates managed and updated manually or through an automated process? |
| The State utilizes a combination of prebuilt phishing templates and internally developed templates created using vendor tools to support realistic simulation scenarios. |
Template management and updates are primarily handled within the platform, with adjustments made as needed to maintain relevance and alignment with current threats.
| 12 |
| Schedule A – Attachment 1 – Business Specification Worksheet, Item 10.0 |
| 83 |
| How does the State currently measure the effectiveness of customized training content compared to standard off-the-shelf content (e.g., engagement levels, reporting rates, or reduction in repeat failures), and are there defined metrics used to evaluate this impact? |
| The State evaluates training effectiveness through completion rates, user feedback, input from security partners, and alignment with current threat trends. |
Formal metrics comparing customized and off-the-shelf content are not currently defined, but insights are used to guide ongoing improvements.
| 13 |
| Schedule A – Attachment 1 – Business Specification Worksheet, Item 10.0 |
| 83 |
| If the State has utilized customized training content, what types of real-world, Michigan-specific scenarios are considered the highest priority for the next contract term (e.g., state-specific social engineering tactics, internal process-based scenarios, or agency-specific risks)? |
| The State prioritizes scenarios focused on current and emerging threats, including AI-driven attacks, phishing, whaling, and other social engineering methods. Training is designed to reflect realistic attack vectors and strengthen situational awareness. |
There is also an increased focus on incorporating physical security awareness and broader risk scenarios relevant to State operations.
| 14 |
| Schedule A – Statement of Work, Section 4 IT Environment Responsibilities |
| 65 |
| Does the State intend for annual Security Awareness training to be delivered through an existing Enterprise LMS, or should the proposed SaaS solution serve as the primary learner interface for training delivery and tracking? |
| SaaS |
| 15 |
| Schedule A – Statement of Work, Section 4 IT Environment Responsibilities |
| 65 |
| For training content delivered through the State’s LMS via SCORM, is the vendor expected to support automated synchronization of completion and activity data back to the SaaS platform to enable centralized reporting and risk analysis? |
| The State will rely on the vendor’s training content and LMS for delivery and tracking. |
| 16 |
| Schedule A – Statement of Work, Section 4 IT Environment Responsibilities |
| 65 |
| Which version of SCORM (e.g., 1.2 or SCORM 2004, including specific editions if applicable) is required for compatibility with the State’s current Learning Management System? |
| SCORM compatibility is not required, as the State will not be using its LMS for training delivery. |
| 17 |
| Schedule A – Statement of Work, Section 3 Purpose |
| 65 |
| Can the State provide an estimate of the weekly level of effort required to manage the current program (e.g., training administration, phishing campaign management, and reporting), and whether reducing administrative overhead is a priority for the next contract term? |
| The State has a designated coordinator who manages the LMS, including training administration, customer support, agency coordination, and other administrative tasks. The vendor is also expected to provide a point of contact to assist with technical issues as well as content-related support, such as training selection, customization, and general content questions. The level of effort varies based on program needs and campaign activity. While reducing administrative overhead would be welcomed, it is not a priority objective for the next contract term. |
| 18 |
| Schedule A – Statement of Work, Section 3 Purpose |
| 65 |
| To what extent are remediation and follow-up training actions currently automated based on user behavior (e.g., triggering targeted microlearning after a phishing simulation interaction), and is expanding this type of automation a priority for the next contract term? |
| Remediation actions are automated in certain cases. For example, users who fail a simulated phishing exercise are automatically assigned phishing-related refresher training. |
The State is open to suggestions and may consider refining its approach in the next contract term.
| 19 |
| Schedule A – Statement of Work, Section 3 Purpose |
| 65 |
| Does the State currently utilize any form of user risk scoring or behavioral metrics to guide training assignments, and if so, how are these applied (e.g., at the individual, role, or departmental level)? |
| The State does not use a centralized user risk scoring system. Each agency decides how to use behavioral data and what follow-up actions to take based on its own business needs. |
| 20 |
| Schedule A – Statement of Work, Section 3 Purpose |
| 65 |
| Does the State currently have a programmatic linkage between individual user behavior (e.g., phishing simulation interactions) and the assignment of targeted or personalized training, and if so, to what extent is this process automated? |
| The State does not have a centralized program that links user behavior to targeted training. Individual agencies make those decisions based on their business needs. |
The State is open to solutions that could improve this process and strengthen overall security.
| 21 |
| Schedule A – Statement of Work, Section 3 Purpose |
| 65 |
| The RFP references reducing the overall cost of conducting security awareness at the agency level. Can the State clarify which cost factors are most significant today (e.g., licensing, administrative effort, program management, or other operational considerations), and where the State sees the greatest opportunity for cost reduction? |
| The referenced cost reduction is primarily addressed by having a statewide security awareness training contract. |
| 22 |
| Schedule A – Statement of Work, Section 5a ADA Compliance |
| 67 |
| The RFP requires an ACR/VPAT for each “product” included in the solution. |
Can the State clarify how “product” is defined in this context, and whether a representative ACR/VPAT for a core training course, combined with documentation describing how accessibility standards (e.g., WCAG 2.1 and Section 508) are applied consistently across all training content, including evaluation methods and remediation practices, would satisfy this requirement?
Product is defined as any component of the delivered solution. Yes, an ACR for a representative module would be okay and including your project methodology that includes accessibility checkpoints for each new module you create for the State would be helpful.
| 23 |
| Schedule A - Statement of Work 3.Purpose |
| 65 |
| "Term of the Agreement: 5 Base Years with 5, 1-Year Options" Does this include annual invoices during the course of the 5 year term? Would an upfront 5 year option also be acceptable? |
| Invoicing cadence to be determined. Upfront 5 year payment would not be acceptable. |
| 24 |
| Schedule A - Statement of Work 2. Background |
| 64 |
| What is the current SOM SAT Solution? |
| Current contract information can be found here: https://www.michigan.gov/dtmb/procurement/contractconnect/contract-list |
| 25 |
| Schedule A - Statement of Work 2. Background |
| 64 |
| What is the current SOM Email Security Solution? |
| Current contract information can be found here: https://www.michigan.gov/dtmb/procurement/contractconnect/contract-list |
| 26 |
| Software Terms & Conditions |
| 27 |
| If a Contractor is proposing a 3rd party hosted software as part of the solution, is the State willing to use that software provider’s terms of use in place of the Software Terms and Conditions and Data Security Requirements in the Solicitation? |
| 3rd party terms are unacceptable |
| 27 |
| Software Terms & Conditions |
| 27 |
| If a Contractor is proposing a 3rd party hosted software that the State is currently using, is the State willing to leverage that software provider’s current terms of use that the State has already agreed in place of the Software Terms and Conditions and Data Security Requirements in the Solicitation? |
| 3rd party terms are unacceptable |