RFI Questions and Answers for Protective Domain Name Service DNS.xlsx
XLSX spreadsheet 28 KB Posted
- Solicitation number
- ID08200DNS
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Questions
| Questions | Answers | |
| 1 | Will the “Provider”, deploy only in the contiguous US? If “NO”, What other locations outside of the contiguous US will be used? | CISA is interested in offering this service internet-wide, with reasonably performant outcomes even outside the contiguous US. |
| 2 | Are there any restrictions to the data? Can it be shared or traverse outside of the US? | No restrictions but we do expect the vendor to advise on best practices and options for anonymizing queries as they move upstream from protective DNS. |
| 3 | The RFI asks for a recommended acquisition approach that the government should take in addressing this requirement. Are there any preferences or constraints at this stage in relation to acquisition approach that should be factored in? | There are no factors or constraints at this time. The Government is looking for industry input, when considering the technical requirements as detailed in the RFI, that will lead to a successful acquisition. |
| 4 | Supplier Question : How would CISA prefer that device attribution be implemented? | CISA is interested in an approach that only allows authorized infrastructure and devices to access the service. In other words, CISA should be able to tell from query metadata that the source is attributed to a given organization. |
| 5 | Supplier Question : Must the Prime contractor build and supply the DNS Resolver Service? | Yes, CISA would expect the prime contractor to build, own, and operate the service. If there are addiitonal considerations to this approach, please provide in RFI response. |
| 6 | Supplier Question : Can the Prime contractor rely on technology partners to provide the DNS Resolver Service? | CISA expects the prime contractor to provide the majority of services (e.g. threat feeds can be sourced from other contractors). |
| 7 | Supplier Question : Please confirm the government will accept a commercial product for the solution, regardless of whether or not it is on the GSA schedule. | Yes. The Government has yet to finalize an acquisition approach. |
| 8 | How does this service relate to the FNPS service under evaluation? | Protective DNS is a separate service than EINSTEIN 3 Accelerated's DNS sinkholing service. It is expected that the details of E3A's operations will not need to be known to the Protective DNS service provider. |
| 9 | Please specify the DNS filtering chain from Agency to Internet (Agency/ISP->This-DNS-Service->IPSS)? | This has yet to be determined and CISA welcome's feedback. However, CISA dos expect that the details of E3A's operation will not need to be known to the Protective DNS service provider. |
| 10 | The cascading of DNS filtering is sub-optimal, May there be a optional service orderable by the Government entity to provide filtering based upon taste or organizational policy? This might increase agency interest. | Generally, we're optimizing for security outcomes and not raw performance. Though performance is a key consideration, filtering actions are only allowed at global level and will be managed by CISA. |
| 11 | Filtering actions, are the commercial and public lists Government furnished or is vendor to propose and provide? | CISA is interested in industry feedback on approach, but generally expect the service to manage the procurement of high-quality threat feeds while allowing for CISA-managed feeds and rules as well. |
| 12 | Filtering actions, are the allow and block lists customizable by agency? Since DNS filtering are cascading, a block at this level would defeat an allow at the Agency filter level. | No. Filtering actions are only allowed at global level and will be managed by CISA. |
| 13 | Would CISA like the service to include more geographically distributed Caching DNS and a few DNS filtering sites? | Yes. CISA is interested in offering this service internet-wide, with reasonably performant outcomes even outside the contiguous US. CISA is interested in feedback on performance and scalability impacts we should consideration. |
| 14 | Will the service expect de-duplication capability to reduce lists and improve performance? | Potentially. CISA is interested in feedback on the recommended best practices for utilizing multiple feeds in a performant and reliable way. |
| 15 | Since there is an ability of CISA to set rules and policies, is it expected that the service would check for conflicting rules and what should the behavior be when a conflict is discovered (e.g. more precise rule wins)? | CISA-managed rules (manual allow/blocklists) will take priority. For example. manual rules will be checked first and if a match is found, no further checks will be performed. |
| 16 | Does this service have to check that the supposed DNS traffic is well formed DNS protocol? | CISA expects the vendor to abide by best current practices for protocol conformance and validation. |
| 17 | In the case of dynamic (e.g. currently registered .gov domains), will CISA identify the sources of input in support of the dynamic behavior or will the vendor need to solution it? | For the named case (.gov domains), yes. Other cases will likely require a collaborative approach. |
| 18 | Are Hidden zones required? | It is unclear what this question is in reference to. No additional information available at this time. |
| 19 | “Filtering decisions should be reflected in the resolver’s responses in near-real time”. Does this require sooner than the Time to live on the cached results? | No. Filtering decisions are expected to be reflected only in resolver's responses in near-real time. |
| 20 | It is not clear what anycast has to do with High Availability, please elaborate. | CISA is interested in industry feedback on approaches to a highly-available, internet-wide accessible, performant service. |
| 21 | Are there any requirements to protect from DNS attacks originating from an Agency? Since this is a shared service, a compromised Agency might impair others. | CISA expects the service provider to monitor the service for sources that negatively impact performance and security. |
| 22 | How many geographic regions/locations should be designed solutioning a response to fit customer’s notational architecture? | CISA is interested in offering this service internet-wide, with reasonably performance outcomes even outside the contiguous US. |
| 23 | How long will a recently registered domain be blocked? Duration? | CISA expects for rules like to be customizable. |
| 25 | Can DHS confirm DNS query per user and per day totals as they appear high | CISA is interested in industry feedback on approaches to model performance needs. |
Sheet2
Sheet3
ESRI_MAPINFO_SHEET
DO NOT EDIT
For Esri use only
File details come from the government source that posted it. Updated .