EINF71823_-_Cybersecurity_Training_-_Addendum_3.pdf

MALIA M. COHEN

CALIFORNIA STATE CONTROLLER

300 Capitol Mall, Suite 1525, Sacramento, CA 95814 | P.O. Box 942850, Sacramento, CA 94250 sco.ca.gov

March 28, 2024

To All Prospective Bidders:

Addendum 3 to Request for Quote for Information Technology Services (RFQ-ITS) EINF71823 Cybersecurity Training

The purpose of this addendum is to notify potential bidders of changes to the State Controller's Office (SCO) RFQ-ITS EINF71823, as well as respond to questions received. As a result of this addendum, the following sections have been changed:

# CHANGE

1 Sample Agreement, Exhibit A, Scope of Work (SOW), Section A. Description of Services

2 Sample Agreement, Exhibit A, Scope of Work (SOW), Section B. Contractor Responsibilities

Response to Questions

1. In the SOW page 1, section B Contractor Responsibilities, 1.a.1 - Is the expectation that the tool resides in the portal, or can it be a link to a third-party service such as Zoom?

Response: SCO is requesting an off-the-shelf solution that provides the features described in the Sample Agreement, Exhibit A, Scope of Work (SOW).

2. In the SOW page 1, section B Contractor Responsibilities, 1.a.2 - Is the portal expected to be already populated or just a place that can support larger files?

Response: Per Sample Agreement, Exhibit A, Item B.1.a.2), SCO is requesting an off-the-shelf solution that provides online access to "expert write-ups, research reports, and recordings". SCO will not provide this information, and it must come from the Contractor.

3. In the SOW page 1, section B Contractor Responsibilities, 1.a.2 - What is the expected storage capability?

Unlimited?

Response: SCO is requesting an off-the-shelf solution that provides the features described in the Sample Agreement, Exhibit A, Scope of Work (SOW). SCO will not host the solution.

4. In the SOW page 1, section B Contractor Responsibilities, 1.a.3 - The technical or service offerings of forums, symposiums, and webinars vary due to their distinct objectives. Can you provide the expectations or service level agreements (SLAs) of these services based on their objectives or purpose?

Response: Per Sample Agreement, Exhibit A, Item B.1.a.3), SCO is requesting an off-the-shelf solution that provides unlimited access to the features.

State Controller’s Office

RFQ-ITS EINF71823

Addendum 3, Questions and Answers

5. In the SOW page 1, section B Contractor Responsibilities, 1.b.1 - What are the cybersecurity domains that cybersecurity experts must be able to cover?

Response: Per Sample Agreement, Exhibit A, Item B.1.f., cybersecurity experts must be able to cover key cybersecurity domains. This should contain technology recommendations, market overviews, and real-life case studies of vendor selection and implementation.

6. In the SOW page 1, section B Contractor Responsibilities, 1.b.2 - Does the polling tool have to be a custom solution, or can it be an external or third-party tool SCO can use?

Response: SCO is requesting an off-the-shelf solution that provides the features described in the Sample

7. In the SOW page 1, section B Contractor Responsibilities, 1.b.3 - The ability to receive a written response seems to be simply email or is the expectation a chat or another form? What would be the SLA or timing expectation?

Response: The requirement was updated. Please refer to Sample Agreement, Exhibit A, Scope of Work

(SOW).

8. In the SOW page 1, section B Contractor Responsibilities, 1.C.1,2,3,4 - Each of the requirements demands different levels of support and resources to host events. What are the minimum requirements or expected services?

9. In the SOW page 1, section B Contractor Responsibilities, 1.d.1 - Who is responsible for anonymizing write-ups or transcripts of expert call discussions?

Response: SCO is requesting an off-the-shelf solution that provides the features described in the Sample Agreement, Exhibit A, Scope of Work (SOW). The Contractor is responsible for providing a solution that includes features identified in Sample Agreement, Exhibit A, Item B.1.d.

10. In the SOW page 1, section B Contractor Responsibilities, 1.d.3 - Expected retention of Symposiums and webinars?

11. In the SOW page 1, section B Contractor Responsibilities, 1.d.3 - What is the SLA or expectation for when on-demand recordings are available?

Response: SCO is expecting this to be a library of previous symposiums and webinars within a month of the event.

12. In the SOW page 1, section B Contractor Responsibilities, 1.d.4 - Who is responsible for providing?

Response: The Contractor.

13. In the SOW page 1, section B Contractor Responsibilities, 1.d.5 - Who is responsible for providing?

14. In the SOW page 1, section B Contractor Responsibilities, 1.d.6 - Who is responsible for providing?

15. In the SOW page 1, section B Contractor Responsibilities, 1.d.6 - What are the industries or cybersecurity domains?

Response: SCO is requesting an off-the-shelf solution that provides the features described in the Sample

16. In the SOW page 1, section B Contractor Responsibilities, 1.d.6 - What is the definition of command center and expected services and capabilities?

17. In the SOW page 1, section B Contractor Responsibilities, 1.E - What are the third-party information security (InfoSec) source requirements?

Response: Refer to Sample Agreement, Exhibit A, Item B.1.e.

18. In the SOW page 1, section B Contractor Responsibilities, 1.E - What is the aggregation criteria?

Response: The Contractor should aggregate all information relevant to all cybersecurity domains.

19. In the SOW page 1, section B Contractor Responsibilities, 1.E - What is meant by “ready-to-use?”

Response: The requirement was updated. Please refer to Sample Agreement, Exhibit A, Scope of Work, Exhibit A, Item B, 1.e.

20. In the SOW page 1, section B Contractor Responsibilities, 1.E - Executive Briefings must be tailored to executive position or type of briefing so can you elaborate on this expectation?

Response: An executive briefing should contain a concise summary of important information or updates to that will be quickly and easily understood by high-level executives. It must include key facts, analysis, recommendations, and insights that are actionable and relevant to decision making at the executive level.

21. In the SOW page 1, section B Contractor Responsibilities, 1.F - What are the areas of research?

Response: Cybersecurity domains.

22. In the SOW page 1, section B Contractor Responsibilities, 1.F - What is the expectation of “dedicated” in reference to research and customers?

Response: The resources should be current and readily available.

23. In the SOW page 1, section B Contractor Responsibilities, 1.F - What is the expectation for customers and what type of research?

Response: The expectation is to have access to the Contractor's other customers anonymized documentation regarding any cybersecurity needs.

24. In the SOW page 1, section B Contractor Responsibilities, 1.F - What are the Key security domains?

Response: All domains under cybersecurity.

25. In the SOW page 1, section B Contractor Responsibilities, 1.G.2 - Is this on-demand access different from section D.3?

Response: The on-demand recordings, trainings, and webinars should be available through the same online access.

26. In the SOW page 1, section B Contractor Responsibilities, 1.H - What is the criteria or threshold for qualifying for CPE credit? And authorized source?

Response: The Contractor must authorize the CPE credit based on the hours a participant utilizes the services.

27. In the SOW page 1, section B Contractor Responsibilities, 1.I - What are the SLAs or thresholds for customer support?

Response: Refer to Sample Agreement, Exhibit A, Item B.1.i.

28. Can you please share Attachment 12 and 13?

Response: The RFQ-ITS was replaced in its entirety and now includes Attachments 12 and 13.

29. What company/solution is SCO looking to have quoted?

Response: SCO is requesting licenses to a term-based, off-the-shelf solution that provides online access to cybersecurity training, tools, templates, and guidance.

30. Is there a way for us to respond to this RFQ without falsely classifying us as a SaaS provider and accepting language that is not applicable?

Response: The RFQ-ITS and Sample Agreement, Exhibit A, Scope of Work, and were updated to remove the Software-as-a-Service (SaaS) requirement.

31. "Rights in Work Product & Government Purpose Rights (Page: 17-18 Section: C) Is there a way we can modify this language to acknowledge this misalignment with the services SCO is buying?

Response: SCO does not have the authority to modify the State of California Information Technology General Provisions.

32. What are the Service Level Agreement (SLA) timeframes regarding all scoping items with requests?

Response: Access to all online information must be available immediately upon agreement execution. For information that must be requested refer to Sample Agreement, Exhibit A, Item B.1.b.3). Refer to Sample Agreement, Exhibit A, Item B.1.i.

33. Are there any onsite requirements for this scope of work?

Response: There are no onsite requirements.

34. What is the time frame(s) for SCO to have access to online and virtual environments?

Response: Refer to Addendum # 2, RFQ-ITS Section I. General Information, Item B. Key Action Dates, Anticipated Agreement Start Date.

35. What are the existing sources of threat intelligence?

Response: This is a new initiative. Existing sources of threat intelligence are not relevant.

All other information will remain the same.

Thank you, SCO Contracts & Procurement Office