VDP EMS - RFP Questions and Answers_Rev 1.pdf

Section 4.2.4: Researcher Engagement and Incentives

● Engagement Goals: Beyond tracking and rewards, what are your long-term goals for the researcher community? For instance, would you like a system that can pull in researchers with specific skill sets for different types of assets? Not at this time but this may be something we look at in the future.

● Vetting & Access: Do you have specific vetting or background check requirements for researchers?

Also, is there a need to restrict access to sensitive assets based on a researcher’s citizenship or trust score? This is not a requirement at this time. Maybe something we look at in the future.

Section 4.2.5: Mission Integration and API Capabilities

● Integration Details: Could you share more about the "existing DC3 IT systems" we’ll be plugging into? Knowing if we’re looking at specific ticketing systems or SIEMs helps us give you a more detailed look at our API capabilities. Current integration is with a DC3 Jira service. We use Jira as a backend, ingest reports via platform API twice a day to update Jira.

● Syncing Data: Are you looking for a two-way sync with your internal ticketing? For example, if a DC3 analyst updates a ticket internally, should the researcher’s view in the EMS update automatically to keep everyone on the same page? At this time not a requirement but is something we’d look at as a potential future upgrade to current systems. Right now this is all one way, from commercial platform to Jira.

● Security Protocols: Are there specific data exchange formats or security protocols we should plan for to meet DC3’s internal IT standards? Current standards. Right now data exchange is done via platform API and API key over port 443.

● Access & Compliance: Will DC3 staff need Single Sign-On (SSO) via CAC/PIV? Also, what FedRAMP or IL levels are required for the data we’ll be hosting? SSO via CAC/PIV is not required at this time. A one-time PIN would be acceptable. Username/strong password is what is currently in use.

● Moving Old Data: Will we need to migrate existing vulnerability data or researcher profiles from a previous system? If so, any idea on the volume? At this time I would have to say probably not. While we’d have to close out any open reports on the commercial platform, those reports are still being worked and processed on out internal Jira service.

Section 4.2.6: Mediation Support

● Handling Disputes: What does your ideal process look like when a researcher and a system owner don't agree on a finding? Should the platform provider act as the final judge in those cases? DC3 analysts work with system owners and the researchers to handle these kinds of issues. DC3 is the final judge.

Section 4.2.7: Vulnerability Triage and Resolution

● Triage Expectations: How do you define "effective triage" here? Are you looking for automated screening, or do you want a partner to manually validate every report to ensure it’s a "true positive" before it hits the DC3 team? All triage work is done by the DC3 VDP analysts team.

● Closing the Loop: When it comes to "resolution," are you mostly interested in technical tracking, or should the platform also help the researcher and remediation team talk to each other to confirm a patch works? DC3 VDP analysts team handles validation of mitigation actions. Ideally the platform should have a “comments” section where analysts can message researchers directly thought the ticket. This is how we currently operate.

● Response Times: Are there specific SLAs or timelines you expect for triaging a report once it’s submitted? The offerors workflow should support DC3 Analyst in conducting effective triage. The offeror’s workflow should have an automation that supports DC3 analyst triage capability within set thresholds. As an example, the automation should allow for a 72-hour threshold, or a 24-hour threshold, depending on need.

● AI & Automation: With adversaries using AI to move faster, are you interested in solutions that use Agentic AI to handle validation and triage at machine speed? Not at this time but this may be something we look at in the future.

● Cleaning up Noise: Does the triage requirement include having the platform automatically ingest and check third-party scanner data to separate real risks from the "noise"? No though currently platform does have automations to help reduce noise from signal ratio.

● AI Governance: What are your requirements for "human-in-the-loop" oversight when AI is used? Do you prefer that AI findings be double-checked by researchers before going to system owners? Our internal analyst team would verify findings of this nature just as they would verify a manually discovered finding.

● Reconnaissance: Do you need the system to use autonomous agents to keep an eye on how your attack surface changes in real-time, ensuring the VDP scope stays accurate? No, this is not a requirement.

Section 4.3.1 & 4.3.2: Account Management, Support, and Logistics

● Support Hours: For the "dedicated account team,” are you looking for 24/7 coverage or is standard business-hour support enough for the DoD and DIB instances? Standard business hours are all that’s required.

● Location: Does the account team need to be physically on-site at Linthicum Heights, or is remote support okay? Remote is fine, there historically never has been a need to have support on site.

● Handling Spikes: Do you have a "burst" requirement for major events (like a new Log4j) where reports might spike 10x? How do you evaluate a platform’s ability to keep up during those times? No, have never had issues with spikes in activity.

● Scaling the DIB: How fast do you expect new DIB companies to join? Does the platform need to support "multi-tenancy" so different companies can manage their own findings while DC3 keeps oversight? No, DIB VDP is a single project, the multi-tenant component is handled via our Jira backend service. Ideally. DC3 analysts should have able to handle adding and removing DIB assets from the scope list on the commercial platform.

● Logistics: Do you have a preferred timeline for the annual mailings, and are there specific security rules for the "secure mailing logistics" mentioned? Monthly and annually from researchers of the month and of the year.

● Data Security: Should all researcher submissions (like PoC videos) be encrypted at rest using Government-managed keys? This has not been a requirement in the past, may be something we look at in the future.

Section M.1: Evaluation Factors for Award

● Highlighting Strengths: Since Section M.1 looks for "superior technical solutions," would the Government see "Auto-Remediation" advice (like providing tailored code snippets for patches) as a significant strength during the evaluation? No, all mitigation is handled at the DoW component level.

Timeline and Proposal Refinement

● Feedback Timeline: To help us finalize our response, when will the Government provide an estimate on when we might receive official feedback for the January 2nd questions? January 12 2026

COB

● Proposal Feedback: Likewise, when will the Government be providing feedback to the RFP submissions due on January 9th? Feedback can be requested after notice of award.

● Question ICO "SS – 2 Provide Vulnerability Submission and Management Workflows. 1.3.2 a) 100% of vulnerability submissions processed and acknowledged within 24 hours e) 95% of vulnerabilities triaged and routed for action within 5 business days" Will the selected vendor be responsible for providing both the service for initial triage of submissions and the workflow for vulnerability submissions? Or will DC3 personnel be conducting triage through the platform's provided workflow? Currently the DC3 team handles this via the commercial platform.

● Question ICO 4.5 Security Requirements - What work is expected to be required to be done that would require the vendor to maintain a TS facility clearance? The contractor team will need a Secret clearance at a minimum.

Is the vendor expected to provide Full Time Employees (FTEs) with a TS clearance for the VDP EMS as well? No.

Questions from 1/6/26

For the security page, what is expected; A standardized NIST CISA output or a different format? Is this done in house or via the contractor? The security page should satisfy the requirements listed in the PWS. The security page should be done by the contractor.

Do you want a reputation system different than CISA or in addition too? Please provide the best solution within your proposal that satisfies the requirements within the PWS.

Triage & Remediation is a daunting task for any of the team, is this in-house or done by the contractor, notes assume we are doing the work? Triage is completed by the contractor.