Cybersecurity RFP Q&A.pdf

Cybersecurity Assessments and Services RFP Questions and Answers

1. Question: Wanted to check regarding if this work requires onsite presence OR can it be done offshore with just coordination from onshore?

Response: There may be times where onsite presence is required, e.g., documentation reviews or meetings, however the expectation is that the majority of the work will be performed remotely and from within the United States. Local travel, if any, will be primarily limited to greater Baltimore and Anne Arundel County. Offshore/international work is NOT permitted.

2. Question: The name of the incumbent vendor currently responsible for the project.

Response: The RFP is the first released. Other entities, under different contract vehicles, have been providing certain of the services within the scope of this solicitation.

3. Question: Please confirm that DOIT will accept both prime and subcontractor qualifications to meet the minimum requirements and references/past performances for Solicitation F50B4600024

Response: Past performance must be that of the Offeror and not any proposed subcontractors. See RFP Sections 1.1.1 - 1.1.4.

4. Question: Could the state please indicate if this program/Solicitation will be included as part of the 2025 MITD RE: Cybersecurity Assessments and Services Solicitation #:

F50B4600024

Response: This solicitation is unrelated to any MITDP.

5. Question: Please indicate how many awards will be made in Category 4—is it one award, or multiple awards for this category?

Response: See RFP Section 2.1.3.

6. Question: Can the same prime submit proposals for all four categories (with the understanding that if awarded category 4, we would be disqualified from categories one through three)?

Response: No. Do not submit for Category 4 if proposing under Categories 1, 2, and/or 3 and do not submit for Categories 1, 2, and/or 3 if proposing under Category 4. Offerors submitting proposals for Categories 1, 2, and/or 3, are precluded from receiving an award for Category 4. Offerors submitting a proposal for Category 4 are excluded from receiving an award for Categories 1, 2, and/or 3.

7. Question: For Category 4 key personnel, can personnel who are in the process of obtaining a CISSP specialization within the next few months be submitted for this effort?

Response: No.

8. Question: It is our understanding that MBE prime offerors may only satisfy 10% of the MBE requirement. Therefore, all offerors will need to have at least one subcontractor to satisfy the full 20% MBE requirement. We believe it would be in the best interest of the Government to evaluate the qualifications of the entire team, including past performance.

Which of the following accurately describes the Government requirement for past performance references?

A. The Offeror MAY provide past performance references from any member of the team (prime or subcontractor) provided each reference meets all requirements stated in the Solicitation regarding size, relevance, and recency. (No change to Solicitation needed.)

B. The Offeror MUST provide at least one reference from each member of the team (prime and subcontractors) and each reference must meet all requirements stated in the Solicitation regarding size, relevance, and recency. (Small change to Solicitation needed)

C. The Offeror MAY ONLY provide past performance references from the prime and MAY NOT include any past performance references by subcontractors. (Small change to Solicitation needed).

Response: See response to Question No. 3.

9. Question: (General) Can MD DoIT please clarify if a response per category 1-4 is needed in Volume one for each of the sub sections A-O? It appears that only sections F-J are category specific and would need to be broken down into 4 unique subsections to speak to each of the four categories.

Response: An Offeror should respond only with respect to the category(ies) to which it is submitting a proposal.

10. Question: Please confirm, or explain further, as indicated in the Bidders Conference 12/20/2023:

This RFP solicitation is for a Master Vehicle. One vendor will be selected per category.

As for funding, see the response to Question No. 3.

Response: See RFP Section 2.1.3. . Funding is unrelated to the Offerors ability to demonstrate performance of work.

11. Question: (Section 5.3.2-G) Can MD DoIT please confirm that each vendor needs to provide three client references per category, a total of 12 client references?

Response: If you are submitting proposals for Categories 1, 2, and/or 3, you cannot submit a proposal for category 4. And vice versa- submitting a proposal for Category 4 excludes you from submitting it for Categories 1, 2, and/or 3. Therefore the number of references an Offeror may need to provide would depend on the number of Categories to which it is proposing . Each category will require three references; however the references may be the same.

12. Question: To fulfill the minimum qualification criteria & references documentation from the past five years, can we provide all three references of our subcontractor we are going to collaborate with?

Response: See response to Question No. 3. References must be those of the Offeror and not any subcontractor(s) an Offeror may be proposing.

13. Question: (Section 5.3.2-G) Can MD DoIT please clarify, if the vendor has performed work across more than one category for the same client, can the same client reference be used for multiple categories?

Response: If the scope of the work performed, with the client reference provided, aligns to more than one category, that same reference may be utilized.

14. Question: (Section 5.3.2-G) Can MD DoIT please confirm for resource resumes we need one resource for category 1-3 (3 total for categories 1-3) and then three resumes for category 4?

Response: Only Category 4 requires resumes to be provided.

15. Question: (General) Can MD DoIT please clarify, are vendors required to reply for all four categories to be considered for any of the four categories?

See response to Question No. 6.

16. Question: Do Labor hour rates apply to Fixed Price work order awards or will only apply to labor hour work orders?

Response: Labor hour rates apply when work orders require them.

17. Question: Section 2.3.1A Paragraph A states that the contractor shall conduct ~70 cybersecurity assessments within 12 months. Does this mean the vendor should anticipate performing ~70 cybersecurity assessments each year for each of the contract follow-on years?

Response: Per statute, cybersecurity assessments are required every two years.

Assessments are required in 2024. The vendor should anticipate this requirement at least every two years, or upon the schedule required by DoIT.

18. Question: How many task orders does DoIT anticipate will be issued per year under the contract?

Response: This has not been determined as of this date.

19. Question: Do you want these cybersecurity assessments to be fully automated or with a manual component for added thoroughness?

Response: The Offeror should propose its solution.

20. Question: Category Two: How many purple team engagements will need to be done in Year 1?

Response: There are no existing requirements for the amount of engagements

21. Question: Will contractors utilize state assets (i.e., laptops, computers, electronic media, etc.) to perform assessments or are contractors expected to use their own assets?

Response: The State will not be supplying such assets.

22. Question: The current budget allocated for the solicitation.

Response: There is no budget amount associated with this project as of yet. Please see RFP Section 6.3 advising that proposed pricing is part of the evaluation criteria.

23. Question: Also, we would like to know the spend amount of last year under this contract.

Response: There is no prior contract.

24. Question: Since we are a new MBE company and started this year. Are we able to use our prior experience before the company was formed? My partners have well over 10 years’ experience and with references. Please contact me at your earliest convenience, thanks.

Response: RFP Section 1.1 requires the experience to be that of the Offeror and not other entities some personnel may have worked for prior to joining the Offeror.

25. Context: With respect to Category 1, DoIT mentions:

“The Contractor shall leverage the State’s Governance, Risk, and Compliance (GRC) platform to create and execute the assessments, track agency responses, report progress and key metrics, create real-time dashboards, identify risks, identify issues, and track agency issue response.”

Question: Should Contractors propose implementation services for ServiceNow (State’s GRC platform) for the following areas, or has DoIT already performed the required configuration of ServiceNow to support this Category in these areas?

Question: A Setup/configuration of ServiceNow to facilitate the Cybersecurity Assessment process/workflow?

Question: B Setup/configuration of related dashboards and reports? Or has DoIT already configured its ServiceNow system to enable the Contractor to perform this work and reporting within ServiceNow?

Response: Category 1 will not be configuring the GRC platform. The Offeror may propose use of related dashboards and reports but these must integrate with ServiceNow.

26. Question: Will the government allow CISSP certifications without the ISSAP or ISSEP specializations for Category 4 key personnel?

Response: No.

27. Question: For newer companies that have been in business less than the required minimum qualifications, are we allowed to use our previous personal experience (that of the Key personnel) as past performance in these categories? I heard you say no on the call, but that is not my experience with other Maryland solicitations. That is why I requested a formal response.

Response: See response to Question No. 24.

28. Question: (General) Can MD DoIT please mention the name of the current GRC platform that the agency uses?

Response: ServiceNow is the existing platform for GRC capabilities.

29. Question: (General) Can MD DoIT please clarify, will access to an existing ServiceNow instance maintained by the state be provided where required for specific work orders?

Response: Access to any needed system/application will be provided to required individuals via work orders.

30. Question: RFP Section 1.1: Will references be accepted from the Offeror (prime) and their subcontractors, or only from the Offeror?

31. Question: RFP Section 2.1.3: We understand an "award to Category 4 will preclude an Offeror from being awarded in any other Category." An Offeror does not know if they will be awarded a contract for any category in which they submit a proposal. As such, would this section preclude an Offeror who is submitting a proposal for Categories 1-3 from submitting a proposal for Category 4, or being included as a subcontractor on a proposal for Category 4?

Response: See response to Question No. 6.

32. Question: RFP Section 3.10.1: Please confirm only awarded Contractors (not all

Offerors) are required to obtain a SOC2 Type 2 audit. When is the awarded Contractor required to complete the audit? Pursuant to 3.10.1G, will the State accept a successful Cybersecurity Maturity Model Certification (CMMC) obtained via external audit in lieu of a SOC2 Type 2 audit?

Response: Only awarded contractors are required to obtain a SOC2 Type 2 audit. Please see RFP Section 3.10.1A, regarding completion of the audit. Please see RFP Section 3.10.1G regarding whether the State accepts a successful Cybersecurity Maturity Model Certification (CMMC) obtained via external audit in lieu of a SOC2 Type 2 audit.

33. Question: RFP Section 5.3.2G: The RFP states, "The Offeror shall identify the qualifications and types of staff proposed to be utilized under the Contract including information in support of the Personnel Experience criteria in Section 3.10.2." There is no Section 3.10.2 in the RFP. Section 3.11.2 "Personnel Experience", states "THIS SECTION IS INAPPLICABLE TO THIS RFP." Please clarify the RFP's requirements for "Experience and Qualifications of Proposed Staff," which is also a Technical Proposal Evaluation Criteria (Section 6.2.2).

Response: Please see Amendment No. 1 to this RFP.

34. Question: RFP Section 6.3: Will the lowest price (most advantageous) Offeror amongst all Qualified Offerors for each Category be awarded a contract? If not, please explain how the pricing evaluation is weighted in relation to the technical evaluation.

Response: See RFP Section 6.5.3.

35. Question: Are bidders required to submit an hourly rate for every labor category listed in the Financial Proposal Excel spreadsheet?

Response: Yes.

36. Question: Will the service provider be asked to perform any system configuration of ServiceNow as part of categories one, two or three or is the intended scope of services for data upload only into ServiceNow?

Response: Such work is not in scope for Categories 1-3.

37. Question: Can one vendor be awarded multiple categories of services within the first three categories (i.e., Assessments, Penetration Testing, and ATO)?

38. Question: Can a contractor who currently performs or intends to bid on work to perform operational delivery around state systems be awarded categories 1, 2, 3 (e.g., networkMaryland, agency-level managed security services, agency managed IT services)?

Response: Yes. See also RFP Section 4.30.

39. Question: On pg. 31 section 3.10, is the intent that a SOC 2 would be required for systems that would house data associated with State cybersecurity artifacts such as testing evidence for assessments or assessment reports?

Response: Yes. See RFP Section 3.10.1.

40. Question: Can a contractor who currently performs or intends to bid on work to perform any IV&V services for DoIT be awarded any of these categories of services?

Response: See Response to Question No. 38.

41. Question: On pg. 8 section 1.1.4, will the State accept any alternative certifications for the CISSP-ISSAP or CISSP-ISSEP?

Response: See response to Question No. 26.

42. Question: Is there a requirement that the individuals with the certifications on page 8 section 1.1.4 be staffed on remediation efforts?

43. Question: Key Information Summary Sheet (pg 3) Please confirm the Financial Proposal: Categories 1-3 is due “after the conclusion of the Technical Evaluation, at the time and date to be stated by the Procurement Officer.”

Response: Correct. See also RFP Section 5.4.

44. Question: Section 2.3.1D What controls from NIST 800-53 and 800-171 may be included:

a. Is it the entire control framework or just select controls?

Response: The entire framework should be considered, however it may be that the entire framework is not applicable to all assessments.

b. How many units of State government are anticipated to require the expanded control set?

Response: There is currently no expanded control set.

45. Question: Section 2.3.1.F Can you confirm that all references to the State’s GRC platform refer to the ServiceNow GRC platform?

a. What formats are available on the State’s GRC platform for importing assessment results?

b. How often does the information in the State’s GRC platform need to refresh - real time or on a regular basis, and what is the integration method (API call, file, etc.)?

c. Does the state currently have a platform that is used for Dashboarding (e.g., PowerBI, Tableau)? If so, what platform is currently in use?

Response: Yes. All references to the State’s GRC platform refer to the ServiceNow GRC platform.

A. Formats compatible with ServiceNow.

B. The refresh cycle is undefined at this time. REST integrations are preferred.

C. The Offeror may propose any dashboard tool. All applications should integrate with ServiceNow. DoIT does have PowerBI, Qlik, and ServiceNow but no specific platform is currently in use.

46. Question: Section 2.3.1.H What level of access control is required over Agency-level results? Can all users see all results, or does there need to be role-based control over who can see which results?

Response: Role-based controls should be established for access to agency level results.

47. Question: Section 2.3.1.K Is POAM functionality already implemented in ServiceNow, or is configuring ServiceNow to manage POAMs part of the work of this task?

Response: Formal POAM functionality is not currently implemented in ServiceNow.

Establishing a POAM process will be required but configuration is not in scope.

48. Question: Category One: Section 2.3.1.A. You want 70 cybersecurity assessments.

What type of assessment do you want?

a. External?

b. Internal?

c. Wireless?

d. 3rd Party?

e. Maturity?

f. Other types?

Response: See RFP Section 2.3.1.

49. Question: Are the Blue Team defenders intended to be State people?

Response: The Blue Team defenders will be a mix of State employees, contractors, and interns.

50. Question: How many internal and external penetration tests are intended for Year 1?

Response: Approximately 60 external penetration tests for year 1. There is currently no amount established for internal penetration tests.

51. Question: What is the budget for this project?

Response: See response to Question No. 22.

52. Question: For Minimum Qualifications (Tab D), please provide guidance re file size limitations in order to upload sample, redacted deliverables. We anticipate the file size for sanitized deliverables will exceed the State of MD threshold.

Response: The uploaded document or file size may not exceed 300,000 KB.

53. Question: 2.3.1,A For Category 1, please provide details re how many agencies fit within the following demographics:

a. Small: <300 users

b. Medium: 300 - 1000 users

c. Large: >1000 users

Response: The number of users is unrelated to complexity level/Category 1 responses.

54. Question: Will the assessments be one-time, or performed annually for all 70 agencies?

Response: See response to Question No. 17.

55. Question: 2.3.1,E Are you currently performing assessments via the GRC tool? Are assessment questionnaires currently created?

Response: Assessments are not currently being performed via the GRC tool. The Offeror should propose its solution/process for performing assessments.

56. Question: Is the entity hierarchy within ServiceNow IRM currently populated with entity data? If so, is this currently tied to the CMDB?

Response: It is not currently populated with entity data.

57. Question: Are controls currently populated within ServiceNow IRM's controls registers?

Response: No

58. Question: Are you currently using ServiceNow IRM's issues management application?

Response: DoIT is in its early stages of development of the IRM module.

59. Question: 2.3.1,F Does DoIT have an existing dashboarding tool it would like to use?

Response: The Offeror may propose any dashboard tool. All applications should integrate with ServiceNow.

60. Question: Who will need to have access to the dashboards? Will individual agencies need a view specific to their agency as well?

Response: Access Controls are to be determined. Dashboards should be able to be exported for reporting and viewing purposes.

61. Question: 2.3.1,J Do the legacy assessments include attachments or evidence that is expected to be integrated into ServiceNow as part of the legacy record migration?

Response: There will be some information that is expected to be integrated.

62. Question: 2.3.2,G Do you expect a unique workflow or changes needed to the Issues Management workflow as it is currently executed within ServiceNow IRM?

Response: Undetermined at this time.

63. Question: 2.3.3,B Do you require contractors to adopt any elements of the current state ATO process to customize the new one within CAM?

64. Question: 2.3.3,E What other enterprise tools/devices do you want SNOW to integrate with for CAM to leverage in its workflow?

Response: Undefined at this time.

65. Question: 2.3.3 The government specified that the contractor should fully manage the

ATO process. In order to estimate the level of effort, please provide:

a. The total number of systems to be managed in the scope of this engagement.

b. The number of systems within each of the three states of System Authorization:

(1) Initial Authorization, (2) Reauthorization, or (3) Continuous Monitoring Assessment (CMA)?

c. The number of systems by categorization level (High, Moderate, Low) Response: Information relevant to work required by the State will be contained in Work Orders issued under the Contract.

66. Question: 2.3.3 d Re the need to "provide training to State employees for conducting

ATOs"… please provide an estimate of the number of employees that will require training and whether a specific training method is required (i.e. classroom, online, etc.).

Response: See response to question 65. The Offeror shall propose its training method.

67. Question: 3.1 For the Pricing Volume, please confirm that pricing will not be required at time of IDIQ response but rather at time of task order response (since contract type might vary between task orders). For bidders responding to more than one category, pricing may also vary depending on type of work / category.

Response: See response to Question No. 43.

68. Question: If a rate card submission is required, please provide guidance re "year over year" rate escalation given the length of contract.

Response: Offerors are responsible for establishing rates.

69. Question: Tab F For Experience and Qualifications of Proposed Staff (Tab F), please confirm that Key Personnel is only required Category 4.

Response: Please see RFP Section 5.3.2G as amended in Amendment No. 1.

70. Question: For Experience and Qualifications of Proposed Staff (Tab F), for Categories 1- 3, please confirm that staffing plans, staff experience, staff qualifications, and organizational charts are not required at time of IDIQ response.

Response: See RFP Section 5.3.2G as amended by Amendment No. 1.

71. Question: Should the Offeror pursue only 1 Category, or should they pursue all the

Categories?

Response: Please see Response to Question No. 6. As permitted, whether to propose to multiple categories is up to the Offeror.

72. Question: Can the Past Performance be from only Prime OR can the Sub-contractor's Past Performance be mentioned?

Response: See response to Question No. 15.

73. Question: 2.3.2 How will the existing ServiceNow GRC platform interface with other cybersecurity tools and systems in place? Is there an existing framework or API documentation available to ensure smooth integration?

Response: See response to Question 45. Systems will be expected to integrate/interface with the GRC platform.

74. Question: 2.3.2 What are the specific parameters and criteria for the system health checks on ServiceNow? Are there predefined metrics or thresholds that the State expects the contractor to use when compiling reports for risk-based remediation?

Response: See response to Question No. 65.

75. Question: 2.3.4 Can you provide more details on the scope and depth of training required for State employees on the ServiceNow IRM Pro CAM solution? Is there a preferred training format or curriculum that the State has in mind?

Response: See response to Question No. 66.

76. Question: 2.3.4 How should the findings and remediation reports be formatted and structured to ensure seamless integration into the State’s ServiceNow IRM/GRC platform? Are there specific data formats or templates that the State prefers?

Response: See response to Question No. 65. Any report or template format must integrate into ServiceNow.

77. Question: 2.3.4 The RFP mentions the need for at least three personnel with CISSP-

ISSAP and/or CISSP-ISSEP certifications. Could you consider just the CISSP certification instead of CISSP-ISSAP or CISSP-ISSEP?

Response: Please see response to Question No. 26.

78. Question: 2.1.3 Could you please simplify this and give us an example to help us better understand what this means?

Response: See responses to Question Nos. 8 and 10.

79. Question: 2.3.1 Can you provide more specifics regarding the scope of the 70 cybersecurity assessments? Are there particular units of State government or types of data systems that will be prioritized?

Response: See RFP Section 2.3.1 regarding scope. Prioritization has not been determined at this time.

80. Question: 2.3.2 What are the specific expectations for the framework of the Adversary

Emulation Program (AEP)? Are there particular models or standards the State prefers to be incorporated into this program?

81. Question: 2.3.3 How will the ATO program be integrated with existing State IT systems?

Is there existing infrastructure or platforms (e.g., ServiceNow IRM) that need to be specifically considered in the development of the ATO program?

82. Question: 2.3.3 Could you provide more detail regarding the expectations for the security architecture and design services? Are there specific technologies, platforms, or standards that the State prefers or requires for these services?

83. Question: 2.3.3 Is Threat Modeling and Secure SDLC part of the scope?

Response: Those are not in scope for RFP Section 2.3.3.

84. Question: 2.3.3 Could you please clarify what types of testing and evaluation is required by the contractor?

85. Question: 2.3.3 Is there an existing system health check service or software that the State currently has that can be utilized for this contract?

Response: The Offeror may propose any tools, software, or service to support their Technical Proposal.

86. Question: Under the minimum qualifications section, we would like clarification on whether it is mandatory for all experience and references to originate exclusively from the prime vendor. Alternatively, are we allowed to leverage subcontractor experience to meet the specified criteria? Additionally, could you confirm if a joint venture arrangement would be considered an acceptable approach?

Response: Please see response to Question No. 3.

87. Question: Could you kindly clarify whether we are permitted to respond to all four categories outlined in the solicitation, or if our response should be limited to specific categories?

Response: Please see responses to Question 6.

88. Question: Will clearances be required? If so, what level is required?

Response: Please See RFP Section 3.8.2.

89. Question: Section: 3.8.2 Security Clearance / Criminal Background Check. If the contractor’s employees supporting the contract maintain a national level security clearance (i.e., Top Secret) under continuing evaluation will a criminal background check and fingerprinting still be required?

Response: Yes

90. Question: Will local travel be required? If so, would the DoIT please provide the addresses for the locations of potential travel or at least the counties where travel would be required?

Response: See response to Question No. 1.

91. Question: Section: 3.10 SOC 2 Type 2 Audit Report – Is a SOC 2 Type 2 Audit Report required for all categories or specific categories? Will the contractor be required to submit this report before or after an award is made?

Response: SOC2 will be required when confidential information is stored and processed on third party systems.

92. Question: Are resumes required for contractor proposal submissions for categories 1 – 3?

Response: See response to Question No. 14.

93. Question: Section 2.3.2 - Would the DoIT consider separating category 2 into two separate categories; one for Purple-Teaming and one category for Internal and External Penetration Testing, as these are two disparate teams and functions that serve different purposes. Having one contractor support both teams/functions could introduce an unwanted bias or conflict of interest in the results. Utilizing separate contractors for these teams would ensure DoIT maintains independence throughout the assessment processes and the addition of the extra category could open the door for stronger competition amongst the vendors.

94. Question: Section 2.3.2 – will the contractor be required to perform any wireless or physical assessments while conducting onsite/internal pentests?

95. Question: May subcontractor references be used to meet the minimum qualifications in sections 1.1.1 through 1.1.4?

96. Question: May subcontractor resumes be used to meet the minimum requirements in section 1.1.4?

97. Question: (Min Quals) If a bidder is responding to Category 1, 2 and 3, will DoIT require three (3) references from each category (9 total)?

Response: See response to Question No. 11.

98. Question: (Min Quals) Will DoIT accept three (3) total references from a bidder responding to multiple categories?

99. Question: (Min Quals) Will DoIT accept references from subcontractors as part of the total three (3) references required?

Please see response to Question No. 3.

100. Question: 4.26.2 "An Offeror must properly complete and submit a separate Attachment D-1A, MBE Utilization and Fair Solicitation Affidavit & MBE Participation Schedule, for EACH Functional Area (I and II) for which it is submitting a proposal. If an Offeror is submitting a proposal for each of Functional Areas I and II, the Offeror must submit two separate Attachment D-1As, one for each of the two Functional Areas" Does Functional Areas here mean Categories? Do we need to submit the Attachment separately for each category we are bidding?

Response: See RFP Amendment No. 1. An Offeror must submit the Attachment separately for each category it may be proposing.

101. Question: 5.2.6 Do we need to submit Word as well as two separate PDF files

(one redacted) for both volumes on eMMA?

Response: See RFP Section 5.2.6.

102. Question: 5.2.6 Does DoIT require a bidder who is responding to multiple categories to submit multiple Technical and Financial Volumes?

Response: No. Supply one Technical and One Financial volume.

103. Question: 5.2.6 If a bidder is responding to Category 1, 2 and 3, will DoIT require three (3) Technical Volumes and Three (3) Financial Volumes; one for each category?

Response: See response to Question No. 102.

104. Question: 5.3 Vol I Tech Proposal - Please confirm the Copy of Certificate of Insurance should be submitted with Proposal or after the award.

Response: Please see RFP Section 5.3.2L.

105. Question: 5.4 Vol II Fin Proposal - RFP states "Financial Proposal for Categories 1-3 will be provided after the conclusion of the Technical Evaluation, at the time and date to be stated by the Procurement Officer. The Financial Proposal for Labor Categories (Category 4) shall contain all price information in the format specified in Attachment B".

Do we need to submit only one Technical Proposal if we are responding to multiple Categories?

106. Question: 5.4 Vol II Fin Proposal - Is this new work? If not, who is the current incumbent? What was the prior budget?

Response: See responses to Question Nos. 2, and 22.

107. Question: What is the current budget for this project?

108. Question: The Draft of the NIST Cybersecurity Framework (CSF) 2.0 will be finalized in 2024. Will the State of Maryland require firms to utilize NIST CSF 2.0 or the current version of NIST CSF for cybersecurity assessments?

Response: If CSF 2.0 is finalized before contract award, then CSF 2.0 will be utilized.

109. Question: For the references, can we use the experience of our employees, or must we use the experience of our company? Our pen testers joined our company about a year ago.

Response: The experience should be that of the Offeror.

110. Question: For Category one you list there are approximately 70 assessments. Is there an estimate for the number of pen testing engagements?

Response: See response to Question No. 50.

111. Question: The pricing sheet has several categories of employees. I assume we only complete the lines that pertain to our category. The estimated hours are listed as 1920 for each line. Are you anticipating full-time engagements? Or as needed for Category 2?

Response: See response to Question No. 35. 1920 hours are used for comparison purposes and do not reflect any commitment by the State.

112. Question: If a vendor is a “channel partner” of a security services company, can the vendor utilize the experiences of the security services company?

113. Question: How many points will be given to the MBE and VSBE?

Response: There are no points for MBEs and there is no VSBE requirement.

114. Question: Timeline/Logistics (Overall Testing) What is the expected timeline of these tests start date/end date?

115. Question: Section 2.3.1 It is mentioned that seventy (70) cybersecurity assessments of units shall be conducted. What is the nature of these assessments? For example - do these reviews of existing policies, or require end to end services including threat modeling, penetration tests, cloud security assessments, and incident response plan?

Response: See response to Question No. 79.

116. Question: Section 2.3.2 There is a mention of Internal and External Penetration Testing - how many internal and external penetration tests need to be conducted? Can you also mention the number of IP addresses that need to be tested?

Response: See response to Question No. 50.

117. Question: Section 2.3.3 There is mention of Authorization to Operate (ATO)

Program Implementation. For how many systems, an implementation is required?

118. Question: Section 2.3.3 How much training needs to be provided to state employees?

Response: See response to Question No. 66.

119. Question: Section 2.3.4(A) How many LANs, WANs, VoIP Networks, Identity and Access Management systems, Mobile Device Management systems, VMWare systems, AWS cloud-based systems, Disaster Recovery backup systems, etc. are there?

120. Question: MBE Certification: It was stated that MBE certification had to be by Maryland DOT. We have verified SDVOSB and VOSB from SAM.gov. Is the Comparable Agency Verification for out of state certifications acceptable?

Response: Maryland only accepts MBE certification approved by the Office of Minority Business Enterprise, a division of the Maryland Department of Transportation.

121. Question: Ts&Cs Does the vendor have to be licensed as a business in Maryland to bid?

Response: See RFP Section 4.21.

122. Question: If we are proposing for more than one category, then do we need to submit separate technical and financial proposals for each category?

Response: See response to Question 105. The Technical and Financial Proposals must be separate from one another.

123. Question: In RFP page 3 of 87 states MBE subcontracting goal: 20% with no subgoals, can you please clarify what does “no subgoals” means?

Response: Subgoals within the Minority Business Enterprise (MBE) Program are part of an ongoing effort to ensure that various racial, ethnic and gender subgroups participate in contracting at levels that would be expected in the absence of discrimination and foster the overarching policy of diversity in contracting for the State. For more information, see https://gomdsmallbiz.maryland.gov/Documents/Legislation/MBE_Program_Subgoal_Gui dance_08.01.2020.pdf .

124. Question: We are MBE certified; do we still need to fulfill the 20% MBE subcontracting goal?

Response: Yes. An MBE prime can satisfy only half of the MBE subcontracting goal.

https://gomdsmallbiz.maryland.gov/Documents/Legislation/MBE_Program_Subgoal_Guidance_08.01.2020.pdf https://gomdsmallbiz.maryland.gov/Documents/Legislation/MBE_Program_Subgoal_Guidance_08.01.2020.pdf

125. Question: Is there currently an incumbent company or previous incumbent, who completed a similar contract performing these services? If so - are they eligible to bid on this project and can you please provide the incumbent contract number, dollar value, and period of performance?

Response: See response to Question No. 2. Entities that may have provided services within the scope of this solicitation are eligible to submit proposals to this solicitation.

126. Question: Specify the VLAN details how many are included in the Scope?

127. Question: Can you please provide the current number of infrastructure details

(Physical Server, Virtual Server, Network Devices, etc.)?

128. Question: How much (%) of the infrastructure is in the cloud?

129. Question: In the IT department/environment, how many employees work?

Response: That information is not relevant to the scope of work in this solicitation.

130. Question: Do you manage your own data Center, or do you utilize any 3rd-party/colocation facilities?

131. Question: there a funding/financial/budget range estimated that can help us to provide a quotation for this project?

132. Question: Would the procurement Office consider extending the due date until February 5th to allow respondents enough time to prepare a comprehensive response in light of the holidays?

133. Question: Will the 20% MBE goal be distributed equally among the 4 categories after award?

Response: See RFP Section 4.26.1. The MBE goal is an overall goal applicable to each contract awarded under this solicitation. Each contractor will need to determine how MBE firm(s) will be used in the performance of work under this contract .

134. Question: Can the procurement office confirm that the following RFP statement

"The Offeror shall provide with its Proposal three or more references from the past five years that can collectively attest to the Offeror’s satisfaction of the requirement." means that all 3 references combined must equal 5 years of past performance?

Response: All references must be for work performed within the five-year period prior to submission of an Offeror’s proposal. The references are not combined to equal 5 years of past performance.

135. Question: Section 5.3.2.F states "The response shall address each requirement in

Section 2 and Section 3 in order and shall contain a cross reference to the requirement."

Should this be only Section 2, or is the respondent expected to address each of the General contract requirements in Section 3 as well? Note: Some of these general requirements do not lend themselves to a written response.

Response: Offerors are to acknowledge each requirement individually and provide corresponding responses.

136. Question: Section 5.3.2.H states "The Offeror shall include information on past experience with similar projects and services including information in support of the Offeror Experience criteria in Section 3.10.1". There is no Offer Experience Criteria in Section 3.10.1, should this be referencing Section 3.11.1 instead?

Response: See Amendment No. 1.

137. Question: Section 5.3.2.G states "The Offeror shall identify the qualifications and types of staff proposed to be utilized under the Contract including information in support of the Personnel Experience criteria in Section 3.10.2." however there is no 3.10.2, will this section be added?

Response: See response to Question No. 33.

138. Question: According to Table 1: RFP ATTACHMENTS AND APPENDICES (LABEL 3), a Labor Resume Form is required for every person being bid on this contract, is that correct?

Response: See response to Question No. 14.

139. Question: On Page 3 the Proposal Due (block) states "Financial Proposal: 1.

(Categories 1-3) After the conclusion of the Technical Evaluation, at the time and date to be stated by the Procurement Officer." Does this mean for Category 1-3 that ONLY a Technical Proposal is due at the close of this RFP?

Response: See response to Question No. 43.

140. Question: Minimum Qualifications Documents, Section 5.3.2 Tab D - Can we provide references of contracts performing as sub?

141. Question: Experience References, Section 5.3.2 Tab D, H, I - Can we use one or more references from our subcontractors?

142. Question: Section 1.1.1, CAT4 - "Offeror shall provide resumes of at least three

(3) personnel on staff" Does this mean that we have to provide resumes of people who are currently employed by us, or we can also provide resumes of people who we are planning to hire in future?

Response: See Response to Question No. 14.

143. Question: Section 5.3.2 - Certificate of Insurance "The current insurance types and limits do not have to be the same as described in Section 3.6. See Section 3.6 for the required insurance certificate submission for the apparent awardee.". Please clarify that you mean section 3.7 and not 3.6.

144. Question: Financial Capability - Please share if we can provide financial statements as a separate attachment or should we provide screenshots of financial statements in our technical proposal?

Response: See RFP Section 5.3.2K.

145. Question: Section 5.3.2 Tab E, bullet #4 - Draft Problem Escalation Procedure:

"Final procedures shall be submitted as indicated in Section 3.8". Please confirm if you meant to write section 3.9 and not 3.8.

146. Question: General/Minimum Quals Docs: If a company is proposing for Category #4 as prime, can they also bid as sub with another prime for the same category? If yes, can a prime use the same references which their subcontractors proposed in their prime bid?

147. Question: Section 5.3.2, Tab C, Attachment M: Contract in RFP, there is no attachment M; "To be provided as an attachment at a later date." In order to accept terms and conditions please provide draft attachment M.

Response: The Contract, attachment M, has been posted on eMMA, Round 2.

148. Question: Can a Joint Venture participate in the solicitation?

149. Question: If a JV can participate in a solicitation, can any of the JV partners provide the experience for each of the Categories?

150. Question: Does the subcontractor experience count toward the required experience for each of the Categories?

151. On the financial proposal, there is a list of labor categories but there is no description of the labor categories and the requirements for each of these labor categories.

i.e. It is not the same as an Application Architect (Senior) with 5 years of experience vs an Application Architect (Senior) with 15 years of experience. The pricing will change significantly based on years of experience, required certifications and responsibilities.

Can you please provide a description of the labor categories in Attachment B?

Response: See Appendix X” at https://procurement.maryland.gov/rfp/ https://procurement.maryland.gov/rfp/

152. Question: In the Attachment B list of labor categories, there are no labor categories for the Certified Information Systems Security Professional. What labor category should we use for the personnel required?

Response: See response to Question No. 151.

153. Question: In section 1.1.1. it is required to provide examples of completed cybersecurity assessments. Most cybersecurity assessments are classified and confidential. Can you reconsider taking this out as a requirement?

Response: The documentation required by Section 1.1.1 - 1.1.4 may be redacted to protect confidential information.

154. Question: For 1.1.3. Does XACTA or eMASS work for experience?

Response: Yes. This is relevant work experience.

155. Question: Section 1.1 As part of the determination to be considered reasonably susceptible of being selected for award, the Offeror must document in its Proposal that, within the last seven (7) years. Our company is only 4 years old, but the companies we acquired exceed 7 years of experience. Can we carry over the previous company's years of experience or can we use the individual's expertise which exceeds 7 years?

156. Question: Section 1.1.3 The Offeror for “CATEGORY 3: Authorization to Operate (ATO) Program Implementation” shall have five (5) years of experience developing an Authorization to Operate (ATO) program and performing system ATOs for a government organization. Does the ATO program and performing system ATOs for a Government Organization have to be in the US? We are a global company and work closely with other Five-Eyes (intelligence Sharing) Countries?

Response: No. Work experience will need to be for organizations in the US.

157. Question: Section 1 - MinQuals: The work products we provide as examples for each category are typically highly sensitive reports that require extensive redaction.

Could this potentially pose an issue during the evaluation?

Response: See response to Question No. 153.

158. Question: Section 1 - MinQuals: Can report templates and sample finding writeups be provided in lieu of an actual redacted report?

Response: See response to Question No. 153

159. Question: Section 1 - MinQuals: The requirement stipulates that one must possess five years of experience in conducting concurrent cybersecurity assessments, and it also requests three or more references from the past five years that can collectively vouch for this experience. This implies that a company with multiple contracts providing these services over the past five years would meet the criteria. However, during the call, it was indicated that three separate contracts, each with five years of concurrent service, are necessary. Could you please clarify the requirement regarding years of experience?

Response: See RFP Section 1.1.1.

160. Question: Section 1.1.3 Req’d Docs: Due to the sensitivity of eGRC/CMDB tools for enterprise organizations, it would be difficult to pull input/outputs from our client's GRC tools without violating NDA agreements. What example artifacts would be accepted by Maryland DoIT to satisfy this required documentation given this constraint?

161. Question: Section 1.1.3 Req’d Docs: Can the offeror reference example artifacts that were created for other Maryland State agencies without having to provide the actual document? If so, how would Maryland like us to cite the source and Point of Contact?

162. Question: Section 2.1.7: Local Entities & Not for Profits: Is there any expectation or anticipated number of local entities or not-for-profits procuring off this contract?

Response: DoIT does not currently possess such information.

163. Question: Section 2.3.1 A: The request specifies that each section should be separated by a "TAB." Could you please clarify whether this requirement pertains to the EMMA system or to a Word document?

Response: See RFP Section 5.3.2.

164. Question: Section 2.3.2, Category 2: Is the state's blue team (network defenders) already in place to integrate with the red and purple teams?

Response: A team has not been fully formed.

165. Question: Section 4.26.9 MBE Goals: The subcontracting goal for Minority Business Enterprises (MBE) is set at 20%. However, if the Prime contractor is an MBE and does not employ any subcontractors, would it still be necessary to engage subcontractors to fulfill the 20% MBE goal?

Response: See response to Question No. 124.

166. Question: Section 4.6 Multiple or Alternate Proposals: Can a contractor bid as a Prime in categories 1-3 while also being a subcontractor on other bids for categories 1-3?

167. Question: Section 5.3.2 TAB Separation: It is requested that each section be separated by a "TAB," can you clarify if this is something in EMMA, or something in Word?

Response: See response to Question No. 163.

168. Question: Section 5.3.2-F Tech Response: We have been requested to provide responses to Section 3, which pertains to General Contractor Requirements. Is the expectation for us to acknowledge each requirement individually and provide corresponding responses for every section as necessary? Or a specific set of sections?

Response: See response to Question No. 135.

169. Question: Section 5.3.2-G Staff experience and qualifications – there is a reference to Section 3.10.2, but there is no 3.10.2. 3.10 is for a SOC 2 report.

170. Question: Section 5.3.2-H Offeror Qualifications there is a reference to Section 3.10.1, 3.10.1 is for a SOC 2 report.

Response: See response to Question No. 136.

171. Question: Section 5.3.2-O Economic Benefit Factors: Could the location of the Prime in Virginia negatively impact the evaluation of the Economic Benefit report?

Response: Each proposal will be evaluated on its own merits.

172. Question: Can the DoIT provide an expected amount of travel per labor category for labor categories 1,2, and 3?

a. If the DoIT is unable to provide expected travel for the labor categories, can the DoIT confirm labor categories 1 and 3 can be accomplished remotely (i.e. access to the GRC tool, remote interviews, etc.).

b. If the DoIT is unable to provide expected travel for the labor categories, can the DoIT provide how many internal penetration tests are expected and how many separate sites there are?

Response: See response to Question No. 1.

173. Question: For labor category 2, will the blue team be comprised only of

State/DoIT personnel, i.e. the contractor is only expected to play red team roles and not blue team roles?

Response: The contractor will not be part of the blue team.

174. Assessment and Penetration test reports have to be redacted of all identifiable information (customer, IPs, points of contact, etc.) so that no attribution to exploitable information can be used, will this be an issue?

175. If an offeror bids on the 4th Task Category as a Prime, are they allowed to be a subcontractor to vendors on the other 3 (1,2 & 3) Category tracks?

Response: See response to Question No. 146.

176. Question: In TORFP Section 1.1.4, it states that “the required documentation the Offeror shall provide with its Proposal is three or more references from the past five years that can collectively attest to the Offeror’s satisfaction of the requirement. Offeror shall provide resumes of at least three (3) personnel on staff with either a Certified Information Security System Professional-Information Systems Security Architecture Professional (CISSP-ISSAP), and/or a Certified Information Security Systems Professional Information Security System Engineering Professional (CISSP- ISSEP).”

Must the personnel on staff be W-2 employees currently employed by the offeror, or can subcontractor personnel, 1099 staff or contingent hires with the necessary certifications meet the documentation requirement?

Response: Personnel must be currently employed by the Offeror.

177. Question: Under section 3.15 Work Orders it states that “In Category 4, work will be assigned on a right of first refusal basis, based on the overall rankings of the successful offerors, beginning with the highest ranked, then the second highest rank, and then the third ranked, and so forth, and beginning again with the highest ranked vendor:

with no change in the original ranking order. Contractor with the highest overall ranking will be given the right of…