ESBD_469827_1765215411529_Q&A.pdf

RFP Number: 737-25-RSOC Dashboard

Questions/Answers Addendum

Based on quantity of questions received as well as updated guidelines from the State of Texas Comptroller we are modifying the timeline of our RFP. Please ensure that you review the updated RFP online as well as sections 1.5 , 1.7 and 2.5 have been modified in the new documents.

1. Are there any mandatory specifications as to which technologies stack, Frameworks and Databases we should be using? No mandatory specifications. We strongly recommend cloud hosted solutions for any components.

a. Examples:

b. J2EE

c. Angular JS, Node JS, React JS

d. Laravel/PHP

e. Backend Database requirements - /Oracle/MySQL/PostgreSQL

2. Is there a Regional Security Operations Center Dashboard already being used for this project or will we need to develop from scratch? Please clarify whether there is an existing RSOC Dashboard supporting these requirements, or if this bid is to develop a totally new System and its related Platform and Infrastructure. There is not an existing data dashboard. The expectation is that one will be developed and operationalized.

3. If there is already an existing system, would you please specify its URL. There is not an existing solution/system.

4. Please indicate whether any existing prototypes, mockups, or sample interfaces are available for this project, or if prototype development is expected as part of the scope of this bid?

None

5. Please clarify if there are in-house (Datacenter) hosting platform/Hardware systems or do we need to supply related cloud hosting infrastructure for your enterprise as a part and parcel of this Bid.

We strongly recommend cloud hosted solutions for the bid response. In-house hosting may be available if a solution requires such for connectivity, security, or other requirements.

6. Are the development, Testing and Production environments expected to be completely cloud-based, or will they be hosted within your traditional data center environments?

We strongly recommend cloud hosted solutions for the bid response. In-house hosting may be available if a solution requires such for connectivity, security, or other requirements.

7. Should our bidding cost include cost of cloud hosting hardware, instances, networks and other resources and their continued IaaS, PaaS, QA Automation and CI/CD solutions?

Any cloud hosting should include implementation and ongoing platform costs.

8. Could you please confirm whether cloud infrastructure or platform services (IaaS/PaaS) are included in the scope of this bid?

Bid responses may include any cloud services needed to deliver the service.

9. Do you have an existing framework or do we need to develop from ground zero based on the requirements mentioned in this bid document.

There is not an existing solution/system.

10. What is the delivery timeline for this product? We need this information so that we can figure out monthly expenses and Time and Material costs. We’ll need this information to plan staff allocation and monthly costs. Fully operational dashboard by March 31, 2027.

We are requesting that bid proposals outline the required timeline expectations.

11. We are technically a Minority as well as Woman owned business. Our HUB registration is in-progress, will we be considered as HUB participant. We encourage you to visit the Comptroller’s website for updates related to the HUB program https://comptroller.texas.gov/purchasing/vendor/hub/

12. How many analysts or developers will build reports & dashboards in this new proposed system? RSOC employees (approx 6)

13. How many people will be able to view the dashboards? 5 - 8 view only access

a. Will they be required to authenticate & log in to view a dashboard?

Authentication and authorization to dashboard data is an important requirement of the solution.

14. Will any of the proposed dashboards be available to the general public? No

a. If so, is ASU considering using a public website, like Tableau Public, to publish some of their dashboards? No

b. If you do not make it public, but want it generally available to a large audience, how many views or analytical impressions do you estimate each dashboard will have?

None

15. Please confirm the primary mission objectives of the RSOC dashboard—statewide reporting, internal RSOC analytics, customer (district) value reports, or all three? All three.

The data dashboard will be used to prepare reports delivered to clients, state and federal stakeholders, and to inform university administration.

16. What is the expected “single source of truth” for SIEM/event data? Microsoft Sentinel?

Does RSOC maintain its own environment? Data may come from existing tools such as Darktrace & CrowdStrike as outlined in RFP Section 3.3 c.

17. Does ASU expect the dashboard to replace current internal reporting methods or supplement them? Internal reporting occurs within individual tools. No existing tool is being replaced that ties data together from multiple sources.

18. Are there specific compliance reports (DIR, TTUS, CMMC, NIST 800-53) that must be templated as part of the dashboard? Not at this time, but as outlined in RFP Section 3.3 a;

would need to be compliant with any regulations.

19. Please provide counts of data sources requiring integration (Sentinel, ServiceNow, Okta, CrowdStrike, Darktrace, Centrepetal AI, others). Outlined in RFP Section 3.3 c

20. Will ASU provide developer-level API keys for all tools, including commercial security platforms? ASU can provide read only API keys for tools involved in dashboard reporting.

Higher level API permissions will need justification.

21. What is the expected ingestion frequency (real time, hourly, daily)? RSOC data dashboard will be used for reporting therefore expected nightly feed to have fresh data reports in the morning.

22. Does ASU require bidirectional integration (e.g., writing alerts back to ServiceNow ITSM)?

No, this is general reporting.

23. How many concurrent dashboard users are anticipated (RSOC Analysts, Leadership, Students, DIR partners, Districts)? DIR Partners and Districts = 0; Students 8-10;

Analysts/Leadership 5-8;

24. Will dashboard authentication be required through Entra ID, Okta, or both? Either could be used for authentication to the dashboard.

25. Are student access privileges restricted by role (observer, builder, contributor)? Yes

26. Should the awardee host the dashboard (SaaS), or should ASU host in its Microsoft tenant?

We strongly recommend cloud hosted solutions for the bid response. In-house hosting

27. If SaaS hosted, must the vendor meet TX-RAMP Level 2 or Level 3? (RFP mentions mandatory TX-RAMP compliance) Solution must meet TX-RAMP Level 2 requirements because of possible sensitive information being included in data sources.

28. Will the dashboard process Category 1 or 1a data (PII, FERPA) requiring enhanced encryption, audit, monitoring?

It is possible the solution could process information that was Category 1/1A. Please design the system to use that information.

29. Should the dashboard store, or only visualize, security telemetry? This is a reporting dashboard, we want to visualize the data that is stored in our tools.

30. Does ASU require FedRAMP High, FISMA Moderate, or NIST 800-53 Rev5 mapping inside documentation?

While not required, NIST 800-53 rev 5 mapping could be useful.

31. How many students per semester will participate? 8-10

32. Should students work as developers, testers, analysts, or shadow observers? Students should be expected to work alongside experts to determine the best and most efficient role.

33. Will students require GitHub/Azure DevOps access to the repo? Yes, limited access based on role.

34. What is ASU’s desired demonstration cadence—bi-weekly, monthly, or milestone-based?

Weekly meeting with possibility of daily email updates.

35. Will ASU assign a Technical Product Owner? Yes, contact person to be announced after contract signed.

36. What data ASU expects Phase 1 Go-Live to include vs Phase 2 enhancements? Open to phased approach as long as operational by March 2027. Looking for proposals to include the data dashboard specs.

37. Do you anticipate a flat Firm-Fixed-Price (FFP) for entire 12-month build? Yes

38. Should multi-year support include student mentorship hours? Yes

39. Are you requesting optional 3-5-year SLAs for maintenance? No, unless proposer feels it is necessary for the maintenance of product and success of dashboard, that option will be considered.

40. Integration: Could you confirm whether any existing data feeds or integrations are already in place with the tools referenced in the RFP (ServiceNow, Okta, CrowdStrike, Darktrace, and Centrepetal AI)? ServiceNow currently receives feeds from CrowdStrike and Darktrace.

41. Link to HUB HSP Plan: The hyperlink to the HUB Subcontracting Plan (HSP) in the RFP document appears to be inactive. Could you please provide an updated link or the correct location to download the required HSP forms? State of Texas Comptroller has modified the document. Here is the updated version https://comptroller.texas.gov/purchasing/vendor/hub/forms.php

42. Evaluation Criteria: The RFP notes that Higher Ed experience accounts for 10% of the evaluation. Will relevant experience in other public sector environments also be considered within this criterion? No

43. Do you expect this to be a product offering (COTS), or can it be a solution that we build specifically for the ASU’s requirements?

Either can be submitted in the bid.

44. Who is the incumbent vendor currently supporting similar services? None exists currently

45. Is the incumbent vendor allowed to participate in this RFP? None exists currently

46. What are the current limitations and challenges that you are facing? No dashboard currently, wanting to visualize and report data.

47. Can you please share details including a) Name of the existing data sources and its types

b) estimated size of each data sources and its YoY growth rate c) where it is hosted? No existing dashboard provider. We are unsure of the size of the data. Would like to be in Cloud.

48. Who will be responsible for hosting?

We strongly recommend cloud hosted solutions for the bid response. In-house hosting may be available if a solution requires such for connectivity, security, or other

49. What is the hosting preference – Cloud vs On-prem? Cloud

50. What hosting provider is currently being used for the existing system, and will the awarded vendor be expected to continue with this provider or propose and manage a new hosting environment? No existing dashboard provider.

51. Do you have any streaming data sources? If yes, please mention in details. Yes, Tools references in RFP Section 3.3 c

52. Is there a requirement for developing a data warehouse? If so, do you have any preferred technologies for its development, such as Azure DWH, AWS, BigQuery, etc.?

No storing of data, just present visualization dashboard.

53. Do you have any technology preferences in terms of developing the dashboards (PowerBI or Tableau)? No we are open to visualization tools, providing input data is secure.

54. Can you please specify the number of dashboards that need to be developed? One primary dashboard for RSOC data

55. Who are the primary stakeholders collaborating with the vendor, and what are their roles?

RSOC Management, university senior leadership, graduate and undergraduate students, faculty

56. Do you have an estimated project start date and desired go-live date? Please mention in months. Project start date is Feb 1, 2026, desired go-live date is March 2027

57. Do you expect the vendor to perform any tasks on-site, or can all work be performed remotely? Vendor must have the ability to travel to the site, when needed. Most work can be performed remotely. As outlined in RFP Section 3.2 student education must be specified in proposal response on location of work performance.

58. Do you accept offshore resources? No

59. What is the approved budget or range allocated for this project? Not set at this time.

60. Are vendors required to already hold FedRAMP or CMMC certification, or is alignment/compliance sufficient? No certification required, alignment is sufficient.

61. Does ASU prefer event-driven ingestion (webhooks/streaming) or batch ingestion for SOC data sources? SOC data dashboard will be used for reporting therefore expected nightly feed to have fresh data reports in the morning.

62. Will historical SOC data be available for backfill, and if so, how many years of data should the dashboard support? Historical data (2-3 years) will be available and team will determine how that data will be represented.

63. Would offshore staff be allowed? No

64. Is remote development acceptable for this project, provided a reasonable way to interact with students is considered? As long as students are actively engaged and data security is maintained, remote development is acceptable.

65. Is a licensed solution (different technology stack) allowed, or will the only allowed licensing (or billing by usage) be in the general ASU’s current Microsoft investments and Enterprise Agreement? We will accept different approaches and technology stacks to deliver the system.

66. Would the COTS and the SaaS requirement be satisfied by data integration over the Azure platform and a general visualization solution such as PBI? Yes, the bidder may choose the tools and method to use to deliver the system.

67. How many total users will access the RSOC dashboard? DIR Partners and Districts = 0;

Students 8-10; Analysts/Leadership 5-8;

68. How many concurrent users do you expect?

DIR Partners and Districts = 0; Students 8-10; Analysts/Leadership 5-8;

69. What user roles will exist (e.g., Tier 1 analyst, Tier 2 analyst, SOC Manager, CISO)?

Proposal to suggest best user roles.

70. Will different roles require customized views or permissions? Yes, access will depend on roles

71. What security tools must feed data into the dashboard? (firewalls, EDR, SIEM, cloud logs, IAM, vulnerability scanners, network appliances, etc.) Please refer to RFP Section 3.3 c

72. How many total data sources are expected initially? 2-4

73. Will new sources be added later? (Scalability requirement) Yes, as needed

74. What formats are the logs in? (JSON, syslog, CloudTrail, API events, CSV, etc.) Primarily API events.

75. What is the estimated log volume per day? (GB/day or events/second) We are unsure at this stage.

76. What is the peak ingestion rate? We are unsure at this stage.

77. What percentage of logs should be retained for analysis vs. archival? This is not a storage just visualization and reporting.

78. How many alerts per day/week are expected across all systems? We are unsure at this stage.

79. How many alerts are high severity vs. low/medium? We are unsure at this stage.

80. Do you require real-time alerting, or is near-real-time acceptable? Near real-time is acceptable as there is no expectation of real-time data.

81. Should the dashboard support correlation rules, risk scoring, or anomaly detection? RSOC Data Dashboard is used for reporting and not monitoring or detection.

82. How fresh must the data be? RSOC data dashboard will be used for reporting therefore expected nightly feed to have fresh data reports in the morning.

a. Real-time (sub-second)?

b. Near real-time (1–5 minutes)?

c. Batch updates (hourly/daily)?

83. Should historical data be analyzed continuously (e.g., last 90 days)? Historical data (2-3 years) will be available and team will determine how that data will be represented.

84. How long must logs and visualizations be retained?

(30 days? 90 days? 1 year? Compliance-driven?) 1 Year.

85. Is cold storage (S3/Glacier) acceptable for older logs?

No data storage requirements.

86. Do you require drill-down to raw logs and events? Yes

87. Should it show:

a. MITRE ATT&CK mapping? No

b. Threat intelligence integration? No

c. Incident lifecycle tracking? No

88. Are custom KPIs required (e.g., MTTD, MTTR, false positive rate)? The proposer is encouraged to add KPIs directly related to the data dashboard's primary purpose, which is visualizing and reporting RSOC performance data.

89. Are there restrictions/preferences on where data can be stored (on-prem vs. cloud)?

We strongly recommend cloud hosted solutions for the bid response. In-house hosting

90. What uptime SLA is considered optimal? The RSOC is manned 24x7x365 so uptime is important.

91. Should the dashboard operate during a security incident or outage? Preferably

92. Do you need multi-region redundancy? Not a requirement.

93. Expected growth of log volume over 1–3 years? Although the data dashboard will initially be used to visualize and report performance data within the RSOC, in the next 1-3 years, log volume growth is expected to increase as more clients are onboarded.

94. Expected increase in users or jurisdictions? Unknown at this time.

95. Will automation or AI-based correlation be required later? Not required initially, but proposers are encouraged to include an AI integration plan.

96. Is CMMC certification a mandatory requirement for vendors delivering only dashboard solutions, or is compliance with CMMC controls sufficient?

There is not a requirement for CMMC certification for this solution/system.

97. Is there a preferred pricing sheet or format for submitting costs and fees, or should vendors use their own templates? Vendors should use their own templates.

98. What is the expected number of concurrent users?

DIR Partners and Districts = 0; Students 8-10; Analysts/Leadership 5-8;

99. Is there a requirement to build custom thresholds on metrics that trigger notifications via email, Slack, etc.?

This system is not expected to alert but to be used for reporting information.

100. Can you please provide specific report generation requirements?

As the expert in this field, we are looking for a vendor that can help us build the best visualization report dashboard to show current and historical trends for the RSOC operations. The proposer is encouraged to add KPIs directly related to the data dashboard's primary purpose, which is visualizing and reporting RSOC performance data. We expect nightly feeds to have fresh data reports each morning for this 24/7/365 operation.

101. Are there requirements specific to data retention? Data retention practices should follow state, federal, and TTUS guidelines and requirements.

102. We will need sufficient time to solution our proposed response based on answers to submitted questions and are therefore requesting a 10 day extension. Will ASU extend the due date? We are unable to make that long of an extension, but have altered to that listed in the updated RFP Section 1.5 of December 15, 2025 at 3pm CST.

103. In the Pre-bid Conference a comment was made that ASU would like for the Dashboard that is created for this project to also be reuseable for other RSOCS--UT Austin, UT Rio Grande Valley, and other future RSOC's. Is this correct? Please validate.

There are no plans at this time for this to be used by other RSOCs.

104. We have a question regarding the HUB requirement for RFP 737-25-RSOC Dashboard.

Our company would be acting as a subcontractor and completing the outlined work in the proposal. We have reached out to XXXXXXX as a potential prime vendor, and they provided the screenshot below. In the CMBL/HUB Vendor Detail, they have a Vendor ID and an account, but their HUB status is listed as inactive.

Given this, would XXXXXX still be eligible to serve as the prime contractor for this solicitation? We encourage you to visit the Comptroller’s website for updates related to the HUB program. https://comptroller.texas.gov/purchasing/vendor/hub/