NDR_RFP_FINAL_S-10700-00010923.pdf

NDR RFP #S-10700-00010923 Page 1 of 45

COVER PAGE

Department of Administrative Services, Enterprise Goods and Services, Procurement Services (“DAS PS”), on behalf of Enterprise Information Services (“EIS”), Cyber Security Services (“CSS”)

Is issuing this Request For Proposals (RFP) under ORS 279B.060 and OregonBuys Bid Number S-10700-00010923 for

NETWORK DETECTION AND RESPONSE SOLUTION (“NDR Solution”)

Date of Issue: 8/05/2024

Opening Date and Time: 9/06/2024

Single Point of Contact (SPC): Brad Wisniewski, State Procurement Analyst

Address: 1225 Ferry St. SE City, State, Zip Salem, OR 97301 Phone (voice) (971) 707-1672 E-mail: Brad.wisniewski@das.oregon.gov

The State of Oregon promotes equal opportunity for all individuals without regard to age, color, disability, marital status, national origin, race, religion or creed, sex or gender, sexual orientation, or veteran status.

mailto:Brad.wisniewski@das.oregon.gov

NDR RFP #S-10700-00010923 Page 2 of 45

SECTION 1: GENERAL INFORMATION

1.1 INTRODUCTION

The State of Oregon (“State”), acting by and through the Department of Administrative Services, Enterprise Goods and Services, Procurement Services (“DAS PS”) on behalf of Enterprise Information Services (“EIS”), Cyber Security Services (“CSS”), (EIS CSS may be referred to as “Agency”) is issuing this RFP to procure a Network Detection and Response (“NDR”) Solution (“NDR Solution”).

The selected Proposer must be able to provide the NDR Solution as described in this RFP, in accordance with Section 3, including all required equipment, configurations, licenses, portals, training, integrations with current security systems, maintenance and operations support.

The State prefers a SaaS, IaaS or COTS solution. For the purposes of this RFP, SaaS refers to a subscription-based services model, IaaS refers to infrastructure as a service, and COTS refers to commercial off the shelf packaged software that can be configured to the needs of the State.

Additional details on the Scope of the Services are included in the Scope of Services, Deliverables, and NDR Solution Functionality section.

DAS PS anticipates the award of one (1) Contract from this RFP. The initial term of the Contract will be two (2) years with options to renew.

1.2 SCHEDULE

The table below represents a tentative schedule of events. All times are listed in Pacific Time.

All dates listed are subject to change. N/A denotes that event is not applicable to this RFP.

Event Date Time

RFP Release to OregonBuys 8/05/2024 By COB

Voluntary Pre-Proposal Conference 8/08/2024 2:30 PM PST

Questions/Clarification/Protests Due 8/15/2024 5:00 PM PST

Answers to Questions/Clarification/Protest posted to OregonBuys 8/20/2024 Approximation

Opening (Proposals Due) 9/06/2024 3:00 PM PST

Evaluation Team Evaluates Proposer Response TBD XXXXXXXXXX

Competitive Range Announcement TBD XXXXXXXXXX

Subsequent Round Evaluation (e.g. POV, Presentations, Demonstrations, Revised Price Proposals, Interviews, etc.)

TBD TBD

Issuance of Notice of Intent to Award (approx.) TBD XXXXXXXXXXX

Award Protest Period Ends 7 calendar days after posting Notice of Intent To Award

NDR RFP #S-10700-00010923 Page 3 of 45

1.3 SINGLE POINT OF CONTACT (SPC)

The SPC for this RFP is identified on the Cover Page, along with the SPC’s contact information.

Proposer shall direct all communications related to any provision of the RFP, whether about the technical requirements of the RFP, contractual requirements, the RFP process, or any other provision only to the SPC.

1.4 ATTACHMENTS

The following attachments are incorporated into this RFP:

Attachment A: Sample Contract Attachment B: Disclosure Exemption Affidavit Attachment C: Proposer Information and Certification Sheet Attachment D: Reference Check Form Attachment E: Price Proposal Attachment F: Certified Disadvantaged Business Outreach Plan Attachment G: Responsibility Inquiry Attachment H: NDR Solution Functionality

SECTION 2: AUTHORITY, OVERVIEW, AND SCOPE

2.1 AUTHORITY AND METHOD

DAS PS is issuing this RFP pursuant to its authority under ORS 279A.050(2) and OAR 125- 246-0140.

DAS PS is using the Competitive Sealed Proposals method, pursuant to ORS 279B.060 and OAR 125-247-0260. DAS PS may use a combination of the methods for Competitive Sealed Proposals, including optional procedures: a) Competitive Range; b) Discussions and Revised Proposals; c) Revised Rounds of Negotiations; d) Negotiations; e) Best and Final Offers; and f) Multistep Sealed Proposals.

2.2 DEFINITION OF TERMS

For the purposes of this RFP, capitalized words will refer to the following definitions.

2.2.1 General Definitions

Capitalized terms not specifically defined in this document are defined in OAR 125-246- 0110.

For terms used in reference to OregonBuys, the Terminology Crosswalk can be found at https://www.oregon.gov/das/ORBuys/Documents/Phase1TerminologyCrosswalk.pdf

2.2.2 Project Specific Definitions

Phishing Attacks: A type of cyberattack that uses fraudulent emails, text messages, phone calls or websites to trick people into sharing sensitive data, downloading malware or otherwise exposing themselves to cybercrime.

http://arcweb.sos.state.or.us/pages/rules/oars_100/oar_125/125_246.html http://arcweb.sos.state.or.us/pages/rules/oars_100/oar_125/125_246.html https://www.oregon.gov/das/ORBuys/Documents/Phase1TerminologyCrosswalk.pdf

NDR RFP #S-10700-00010923 Page 4 of 45

Malware Infections: An umbrella term that describes any intended malicious program or code that is harmful to systems. Malware Infections seek to invade, damage, or disable computers, computer systems, networks, tablets, and mobile devices, often by taking partial control over a device’s operations. Examples of Malware Infections include viruses, worms, trojans, and other harmful programs to gain access to sensitive information.

NDR Solution Sensors: Physical devices deployed at strategic points within the network that monitors individual packets of inbound and outbound traffic to and from all devices on the network, while analyzing them for malicious activity. These sensors analyze every network packet on the segment under observation, and forwards packets deemed interesting together with an alert message to a backend system that stores them for further analysis and correlation with other events.

Application Programming Interfaces (APIs): A set of rules or protocols that enables software applications to communicate with each other to exchange data, features and functionality.

Intrusion Detection and Prevention System (IDPS): A system that monitors a network for possible threats to alert the administrator, thereby preventing potential attacks.

Machine Learning: A branch of artificial intelligence (AI) and computer science that focuses on the using data and algorithms to enable AI to imitate the way that humans learn, gradually improving its accuracy.

Wizard-style AI: A form of AI which specializes in machine learning reliability within the AI sector and is comprised of a suite of machine learning testing and governance tools designed to produce fair, auditable, transparent, and explainable models, and to mitigate risks in both development and production phases.

Large Language Model AI: A deep-learning algorithm that is trained on immense amounts of data and parameters to provide the foundational capabilities needed to drive multiple use cases and applications, as well as resolve a multitude of tasks. These generative AI-based models are capable of performing various natural language processing tasks beyond simple text generation, including revising and translating content, and are designed to capture intricate language patterns and perform a wide array of language-related tasks.

2.3 OVERVIEW AND PURPOSE

2.3.1 Agency Overview and Background

EIS CSS’ mission is to bring together enterprise security capabilities into a single organization. EIS CSS is responsible for enterprise security policy, security monitoring of the state network, enterprise incident response, and enterprise security architecture, as well as dissemination of security training, policy, and best practices across state government. EIS CSS works collaboratively with the State’s Data Center Services (DCS) and agencies to support information security functions and ensure the security of the state network and Information Technology (IT) infrastructure.

EIS CSS is responsible for the oversight of information security risk management and mitigation as well as providing risk assessments to over 65 agencies statewide. The State expects the NDR Solution to accommodate and ingest large amounts of data and have the capability of supporting state agencies’ data through the Contractor’s portal. EIS CSS will be responsible for the local administration of on-boarding and training the agencies on the use of the NDR Solution.

NDR RFP #S-10700-00010923 Page 5 of 45

While all agencies are collectively responsible for information security, the work of EIS CSS supports and increases the collective impact and resilience of state agencies. Moving forward, EIS CSS is focused on the seamless integration of information security, solutions, and personnel into a coordinated multi-sector approach that recognizes cybersecurity as a public good.

Infrastructure Description

The investment in this Solution will provide the State enterprise, consisting of approximately 90,000 actively connected network systems (with an additional 47,000 intermittently connected) and 50,000 employees, with the additional cybersecurity tools to help provide additional proactive cybersecurity protections to Oregon assets.

The State enterprise utilizes approximately 32Gbs of bandwidth on an average day with peaks around 45Gbs. EIS CSS’ Security Team will need the ability to filter out extraneous traffic (e.g. nightly backups, vulnerability scans, patch updates). NDR Solution Sensors will be required at the State perimeter and internally at various border locations, including cloud and backup data center. There will be 3 on-premises locations for the NDR Solution Sensors to monitor traffic on Gigamon, or similar infrastructure, mirrored ports.

2.3.2 Project Overview and Background

EIS CSS has decided to procure an NDR Solution due to a significant increase in cybersecurity threats and the need to enhance its overall security posture. Recent incidents, such as Phishing Attacks and Malware Infections, have highlighted the inadequacy of the current security measures in detecting and responding to advanced threats. EIS CSS has recognized the importance of proactive threat detection and real-time incident response to prevent data breaches and ensure business continuity.

NDR RFP #S-10700-00010923 Page 6 of 45

NDR Solutions detect abnormal system behaviors by applying behavioral analytics to network traffic data. They continuously analyze raw network packets or traffic metadata between internal networks (east-west) and public networks (north-south). NDR Solutions can be delivered as a combination of hardware and software appliances for NDR Solution Sensors, and a management and orchestration console in the form of an on-premises software or SaaS.

Organizations rely on NDR Solutions to detect and contain post data breach activity such as ransomware, insider threats, or lateral movements. Additionally, NDR complements other technologies, which trigger alerts primarily based on rules and signatures, by building heuristic models of normal network behavior and spotting anomalies.

Core capabilities include:

• Ability to gather activity from raw traffic.

• Metadata enrichment at the time of collection or during event analysis.

• Deployment form factors compatible with on-premises and cloud networks.

• Machine Learning (ML) techniques to baseline normal activity and detect abnormal behaviors.

• Behavioral Analysis to identify deviations from normal network behavior, helping to detect anomalies and potential security threats.

• Alert aggregation into logical security incidents based on multiple factors, not only alert ID and repeated alerts.

• Automated responses, such as host containment (through integration) or traffic blocking.

• Ability to use Wizard-style or Large Language Model AI, which would enable Security Operations Center (SOC) analysts to use a templated/guided framework to hunt for threats.

• The NDR Solution must be implemented using technologies that will support on-premises and cloud environments.

Therefore, DAS PS is soliciting proposals from qualified vendors to provide a comprehensive NDR Solution that can effectively monitor and analyze network traffic, detect anomalies and malicious activities, and integrate with existing security infrastructure. Prospective Proposers should emphasize their ability to tailor the NDR Solution to the specific requirements of the enterprise, how ongoing support and maintenance will be provided, and ensure compliance with regulatory requirements and industry standards.

Deployment options may include on-premises or cloud-based NDR Solutions.

2.4 SCOPE OF SERVICES, DELIVERABLES, AND NDR SOLUTION FUNCTIONALITY

2.4.1 Scope of Services

The Proposal must include a description of the proposed Services using the information provided in this section, Scope of Services.

In addition to the Functionality requirements referenced in Section 2.4.3, Proposer’s Scope of Services must include the following:

NDR RFP #S-10700-00010923 Page 7 of 45

• Sample Implementation Plan: Proposer shall provide a sample implementation plan for the activities to design, configure, implement, and deliver the proposed NDR Solution in a phased approach. The sample implementation plan must be described at a high-level with diagrams within the Proposal.

• Proposed Sample Statement of Work (SOW) with timeline: Proposer shall submit a sample SOW with timeline, electronically as a Microsoft Word File (DOC).

• Sample Test Plan: Proposer shall provide a sample plan for supported testing and acceptance of the proposed NDR Solution.

• Sample Training Plan: Proposer shall submit a sample training plan that details how Agency staff will be trained on the operations of the NDR Solution. The sample training plan should include a syllabus for instructor-led training and/or on-demand training.

Training needs will be broken down by persona/role, so it is clear what level of training is required. Help pages or administrator handbooks are not considered training in this context.

• Licensing Costs: Proposer shall provide its pricing schema (e.g. Per throughput flows, per IP address of device, per user, monthly fee, or other) and an itemized list including additional licensing costs for proposed modules, appliances, support, training for all mandatory and desirable functionality.

• Ongoing Maintenance and Support: Proposer shall describe how it will continue to support EIS CSS after closing completing SOW activities and transition to maintenance and operations post “go live”.

• Reporting Samples: Proposer shall provide sample reports from dashboards, sample executive reports with overview, and sample technical deep dives.

The proposed Services must include any additional deliverables that Proposer believes are necessary to fully deliver this NDR Solution. Each deliverable must be called out by title, with itemized pricing included for each of them as required for the items above.

2.4.2 Tasks and Deliverables

Proposer should include each of the following in its proposed Services description:

• Weekly Status Report – The weekly status report must include an overall SOW implementation status (with completed work), and an update to the schedule.

• Functional Design Document (FDD) – The FDD must contain a detailed functional design for the NDR Solution. The FDD must also contain details regarding the security of the system at a functional level. This deliverable will include the final design prior to ‘go live.’

• Requirements Traceability Matrix (RTM) - Proposer must be able to support requirement revisions throughout the different phases of the NDR Solution. Prior to Final Acceptance, Proposer shall reconcile all requirements against the delivered, tested NDR Solution to ensure Proposer has clearly and transparently met each requirement. In addition, the RTM must include State agreed upon structure/elements and confirm clear mapping from requirements, to design documentation, and accurate gap analysis identification between design and NDR Solution functionality. Proposer shall update the RTM as necessary to reflect the

NDR RFP #S-10700-00010923 Page 8 of 45 state of the NDR Solution throughout the phases of the project. Proposer shall configure, deliver, and maintain the RTM which must include original requirements, updated requirements, and any change requests identified and agreed upon.

• Technical Design Document (TDD) – The TDD must contain a detailed technical design of the entire NDR Solution. The TDD must also contain the RTM for the NDR Solution and details regarding the security of the system at a more technical level.

This deliverable may need periodic refreshes during the life of the project.

• Interface Control Documents – Depending on the number of systems (refer to Attachment H, NDR Requirements) that will require interfacing, the Interface Control Documents must detail all interfaces needed and include any recommended changes needed on the interfacing systems. The State prefers the use of Application Programming Interfaces (APIs). This Deliverable may need periodic refreshes throughout the life of the project.

• Test Plan and Test Cases – The Test Plan must contain a detailed description of Proposer’s testing plan to include internal testing, be it unit, performance, system integration, security, penetration, or other types of testing mutually agreed upon.

The Test Plan must also contain all test cases that are planned for execution by Proposer and any that Proposer would recommend for the State to run during User Acceptance Testing (UAT). This Deliverable may need periodic refreshes throughout the life of the project.

• Training Plan – This deliverable may need periodic refreshes.

• Ongoing Maintenance and Operations Plan – Proposer should submit a plan for ongoing maintenance and operations responsibilities as the work moves from implementation to maintenance and operations, clearly outlining any change in the management processes.

2.4.3 NDR Solution Functionality

The detailed NDR Solution Functionality for this project is found in Attachment H. Proposer must review and detail how its proposed NDR Solution meets each item in the Solution Functionality.

The high-level description of the Solution Functionality is as follows:

• Deliver via form factors (physical or virtual sensors) that are compatible with on-premises and cloud networks to analyze raw network packet traffic or traffic flows (for example, IP flow information). NDR Solution must also monitor north-south traffic (as it crosses the perimeter) and east-west traffic (as it moves laterally throughout the network).

• Model normal network traffic and highlight unusual traffic activity that falls outside the normal range. NDR Solution must also provide detection based on behavioral techniques (non-signature-based detection), including ML and advanced analytics that detect network anomalies.

• Aggregate individual alerts into structured incidents to facilitate threat investigation and provide automatic or manual response capabilities to react to the detection of malicious network traffic.

• Monitor and analyze traffic in IaaS and SaaS environments.

NDR RFP #S-10700-00010923 Page 9 of 45

• More traditional detection techniques, such as Intrusion Detection and Prevention System (IDPS) signatures, rule-based heuristics, and threshold-based alerts

• Alert aggregation of logical security incidents based on multiple factors, not just alert ID, and repeated alerts through integration with other SOC tools for richer context.

• Automated responses, such as host containment (through integration) or traffic blocking, directly or through integration with other cybersecurity tools.

• A low false positive rate, after initial tuning, to become a trustable source of insight and support automated response use cases.

SECTION 3: PROCUREMENT REQUIREMENTS

3.1 MINIMUM SUBMISSION REQUIREMENTS

3.1.1 Round 1 Proposal Submissions

To be considered for evaluation, the Proposal must contain each of the following elements (further details located in Section 3.2, Round 1 Proposal Requirements):

• Proposer Information and Certification Sheet (Attachment C)

• Executive Summary

• Experience and Capabilities

• Staffing Plan, Key Persons, Organizational Chart and Subcontractors

• Proposer’s Organizational Profile

• Scope of Services (as outlined in Section 2.4.1) o Sample Implementation Plan o Sample Statement of Work (SOW) o Sample Test Plan o Sample Training Plan o Licensing Costs o Ongoing Maintenance and Support o Reporting Samples

• NDR Solution Functionality (Attachment H)

• Security Statement or Alternative

• Performance Metrics and Service Level Agreements (SLAs)

• Price Proposal (Attachment E)

• Reference Check Forms (Attachment D)

• Underlying Agreements, if applicable

• Certified Disadvantaged Business Outreach Plan (Attachment F)

NDR RFP #S-10700-00010923 Page 10 of 45

• Disclosure Exemption Affidavit (Attachment B) – submit 1 copy only

• Responsibility Inquiry (Attachment G)

• Miscellaneous Provisions (See Section 3.2.18)

3.1.2 Proposal Page Limits

Proposal is limited to 20 pages. Any pages exceeding this limit will not be provided to the evaluation committee or considered in the evaluation. The following items do not count toward the page limit:

• Disclosure Exemption Affidavit (Attachment B)

• Proposer Information and Certification Sheet (Attachment C)

• Reference Check Forms (Attachment D)

• Price Proposal (Attachment E)

• COBID Certification / Outreach Plan (Attachment F)

• Responsibility Inquiry (Attachment G)

• NDR Solution Functionality (Attachment H)

• Project samples

• Underlying agreements

3.1.3 Proposal Format and Quantity

Proposal must follow the format and reference the sections listed in the Proposal Requirements section. Responses to each section and subsection must be clearly labeled to indicate the item being addressed.

OregonBuys Electronic Response. Proposer must submit its Proposal electronically through OregonBuys. Proposer must follow the procedures outlined in Section 4.6.1 for electronic submission.

The Price Proposal must be submitted as a separate electronic response file.

Proposer shall submit one copy of its Proposal and all other submittal requirements, with Attachment C, Proposer Information and Certification Sheet, bearing the Proposer’s authorized representative’s Signature, in one of the following formats: Adobe Acrobat (pdf), Microsoft Word (docx), or Microsoft Excel (xlsx). If Proposer believes any of its Proposal is exempt from disclosure under Oregon Public Records Law (ORS 192.311 through 192.478), Proposer shall complete and submit Attachment B, Disclosure Exemption Affidavit. Proposer shall also mark as “Confidential” in OregonBuys all attachments to its Proposal that Proposer believes are exempt from disclosure.

3.2 ROUND 1 PROPOSAL REQUIREMENTS

Proposal must address each of the items listed in this section and all other requirements set forth in this RFP. Proposer shall clearly describe the Goods to be provided or the Services to be performed or both. A Proposal that merely offers to provide the goods or services as

NDR RFP #S-10700-00010923 Page 11 of 45 stated in this RFP may be considered non-Responsive to this RFP and will not be considered further.

Proposal should not include extensive artwork, unusual printing or other materials not essential to the utility and clarity of the Proposal. Do not include marketing or advertising material in the Proposal. Proposal should be straightforward and address the requests of the RFP. Proposal containing excess marketing or advertising material may receive a lower evaluation score if specific information is difficult to locate.

3.2.1 Proposer Information and Certification Sheet

Proposer shall complete and submit Attachment C, Proposer Information and Certification Sheet.

The Proposer Information and Certification Sheet must bear Proposer’s authorized representative’s Signature. Failure of the authorized representative to sign the Proposal may subject the Proposal to rejection by DAS PS.

Failure to demonstrate compliance with Oregon Tax Laws and sign Attachment C, Proposer Information and Certification Sheet, may result in a finding of non- Responsibility.

3.2.2 Executive Summary

Proposer shall provide an Executive Summary that captures the essence of Proposal.

3.2.3 Experience and Capabilities (Scored)

Proposer must demonstrate Proposer has the following experiences and capabilities:

• Proposer must have at least five (5) years of experience producing, implementing, configuring, and supporting NDR Solutions.

• Proposer must have at least three (3) years of experience working with governmental entities.

• Proposer must have at least one (1) NDR Solution successfully implemented in the past three (3) years of similar scope and size.

3.2.4 Staffing Plan, Key Persons, Organizational Chart and Subcontractors (Scored)

Staffing Plan. Proposer shall submit a Staffing Plan, identifying proposed Key Persons, staff, and/or subcontractors and their experience. The Plan must identify a person with whom project risks, issues, or concerns can be escalated if the project team is unable to resolve them. The Plan must also identify a dedicated development/technical manager and a training manager.

Key Persons. Proposer shall specify key persons to be assigned to the Services and position and include a current resume (not to exceed two (2) pages each) for each individual that demonstrates qualifications and experience for the Services proposed.

Key Person(s) requirements are:

NDR RFP #S-10700-00010923 Page 12 of 45

• Strong project management, business analysis, and experience and knowledge in networking and NDR systems.

• Recent experience (within last three (3) years) and knowledge serving as consultant/advisor in reviewing, making recommendations, to implement best practices and meet functional requirements.

• Recent experience (within last three (3) years) developing, performing, and facilitating NDR system testing activities.

• Demonstrated experience (within the last three (3) years) in complex NDR integration projects.

Preferences for Key Persons:

• Strong understanding of public sector environment is preferred.

• Due to the nature of services, Key Person(s) must be available to work remotely and in the State offices as agreed upon between all parties. Work site is designated as EIS CSS offices in Salem, Oregon, may be required.

Organizational Chart. Proposer shall provide an organizational chart identifying the staffing that will provide the Services required by this RFP, illustrating the lines of authority as appropriate.

Subcontractors. If Proposer intends to work with subcontractor(s), Proposer shall include a statement detailing any subcontracting firms or individual subcontractors that may be engaged as part of the Proposal to this RFP, with those entities and the Services they will provide clearly identified.

3.2.5 Proposer’s Organizational Profile (Scored)

Proposer must provide a profile of its organization. This is Proposer’s opportunity to give an overview of its organization, describe the structure of its business, and discuss how the organization can effectively deliver the Services described in this RFP. The Profile must include:

1. Ownership. If incorporated, the state in which the organization is incorporated and the date of the incorporation;

2. Location of the organization’s offices (headquarters and branches);

3. Location of the office from which employees will be assigned to provide the services for the Agency;

4. Number of employees located in the Pacific Northwest, nationally, and internationally;

5. Established business relationships with proposed subcontractors (e.g., data conversion contractor); and

6. Organization’s client base.

3.2.6 Scope of Services (Scored)

Proposer must submit a sample SOW, meeting all requirements of the Project as described in this RFP, including as defined in Section 2.4.1, Scope of Services.

NDR RFP #S-10700-00010923 Page 13 of 45

3.2.6.1 Sample Implementation Plan (Scored)

Briefly describe how Proposer would carry out the major activities for these services in context with the Scope of Services set forth in Section 2.4. Provide a comprehensive plan that Proposer intends to follow. Illustrate how the plan will serve to coordinate and accomplish the SOW.

3.2.6.2 Sample SOW (Scored)

Proposer shall submit a sample SOW with timeline, electronically as a Microsoft Word File (DOC).

3.2.6.3 Sample Test Plan (Scored)

Proposer shall provide a sample plan for supported testing and acceptance of the proposed NDR Solution.

3.2.6.4 Sample Training Plan (Scored)

Proposer shall submit a sample training plan that details how Agency staff will be trained on the operations of the NDR Solution. The sample training plan should include a syllabus for instructor-led training and/or on-demand training. Training needs will be broken down by persona/role, so it is clear what level of training is required. Help pages or administrator handbooks are not considered training in this context.

3.2.6.5 Licensing Costs (Scored)

Proposer shall provide its pricing schema (e.g. Per throughput flows, per IP address of device, per user, monthly fee, or other) and an itemized list including additional licensing costs for proposed modules, appliances, support, training for all mandatory and desirable functionality.

3.2.6.6 Ongoing Maintenance and Support (Scored)

Proposer shall describe how it will continue to support EIS CSS after closing completing SOW activities and transition to maintenance and operations post “go live”.

3.2.6.7 Reporting Samples (Scored)

Proposer shall provide sample reports from dashboards, sample executive reports with overview, and sample technical deep dives.

3.2.7 NDR Solution Functionality – Attachment H (Scored)

Proposer shall submit a narrative (via column G of Attachment H, NDR Solution Functionality) addressing the high-level requirement categories set forth in Section 2.4.3.

Proposer shall complete and submit Attachment H, NDR Solution Functionality.

SPECIAL NOTE: The NDR Solution must be able to perform all mandatory functionalities identified in Attachment H, NDR Solution Functionality, as measured and validated during Round 2 – Proof of Value (POV) and testing prior to go-live.

NDR RFP #S-10700-00010923 Page 14 of 45

3.2.8 Security Requirements (Scored)

To be considered for evaluation, Proposer must provide a narrative statement that demonstrates how Proposer meets all requirements of this section. Or, in the alternative, Proposer may provide one of the following to demonstrate compliance with Oregon’s Information Technology Control Standards:

1. Proof of current StateRAMP Authorized status (Ready, Provisional, or Authorized) in the form of a StateRAMP Letter, or

2. Documentation of a valid StateRAMP Security Snapshot Score.

If Proposer is submitting a narrative statement, the narrative statement must demonstrate how the NDR Solution Provider follows a secure software development lifecycle (SDLC) process including, but not limited to secure coding practices, patch management, integrating DevSecOps into DevOps, testing, and incident response. Proposers may submit supplemental documentation to support this narrative.

Proposer is encouraged to look at the best deployment for a NDR Solution for the State of Oregon in alignment with the State’s cloud strategy, found at:

https://www.oregon.gov/das/OSCIO/Documents/EIS_CloudForward.pdf

Data Protections

• Proposer understands and has the capability of handling and protecting Agency Data that has been classified as Level 3 Information under the State of Oregon’s Information Asset Classification policy, available online at https://www.oregon.gov/das/Policies/107-004-050.pdf .

• Proposer and its employees, contractors, and agents shall comply with all applicable state and federal laws and regulations, and State of Oregon policies governing Agency Data and its use and disclosure, including as those laws, regulations, and policies may be updated from time to time, including:

• Oregon’s Statewide Information Security Standards, viewable at:

https://www.oregon.gov/eis/cyber-security-services/Pages/guidance-for-state-agencies.aspx including security controls that meet or exceed “Moderate” security controls in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53.

• Oregon’s Statewide Information Security Plan, found online at:

https://www.oregon.gov/eis/cyber-security-services/Pages/guidance-for-state-agencies.aspx

• Statewide Cloud Computing policy:

http://www.oregon.gov/das/policies/107-004-150.pdf

• Oregon’s Statewide Information Technology Policies:

www.oregon.gov/das/Pages/policies.aspx#IT

• Privileged Access Monitoring and Reporting, viewable at:

https://www.oregon.gov/das/Policies/107-004-140.pdf

• Cloud Forward, viewable at:

https://www.oregon.gov/eis/siteassets/eis-cloud-forward-20230116.pdf https://www.oregon.gov/das/OSCIO/Documents/EIS_CloudForward.pdf https://www.oregon.gov/das/Policies/107-004-050.pdf https://www.oregon.gov/eis/cyber-security-services/Pages/guidance-for-state-agencies.aspx https://www.oregon.gov/eis/cyber-security-services/Pages/guidance-for-state-agencies.aspx https://www.oregon.gov/eis/cyber-security-services/Pages/guidance-for-state-agencies.aspx https://www.oregon.gov/eis/cyber-security-services/Pages/guidance-for-state-agencies.aspx http://www.oregon.gov/das/policies/107-004-150.pdf http://www.oregon.gov/das/Pages/policies.aspx#IT https://www.oregon.gov/das/Policies/107-004-140.pdf https://www.oregon.gov/eis/siteassets/eis-cloud-forward-20230116.pdf

NDR RFP #S-10700-00010923 Page 15 of 45

• Oregon Consumer Privacy Act (OCIPA), viewable at:

https://www.oregonlegislature.gov/bills_laws/ors/ors646a.html

Security Requirements

To the extent the standards apply to Proposer’s proposed NDR Solution and related Services, Proposer must substantially comply with all the following minimum standards:

• Privileged Access Monitoring and Reporting, viewable at:

https://www.oregon.gov/das/Policies/107-004-140.pdf

• Statewide Information and Cyber Security Standards, viewable at:

https://www.oregon.gov/eis/cyber-security-services/Documents/eis-css-statewide-information-technology(IT)-control-standards.pdf

• Statewide Cloud Computing Policy, viewable at:

http://www.oregon.gov/das/policies/107-004-150.pdf

• Proposer shall sign a non-disclosure agreement for any and all information received or processed on its equipment from the State of Oregon.

• Proposer shall always protect State of Oregon sensitive materials.

Background Checks

Proposer and Proposer's staff monitoring the systems who will have access to State systems, facilities, and confidential information will submit to all security checks requested by Agency, which may include any combination of fingerprinting, Oregon Law Enforcement Data Systems (“LEDS”) and Federal Bureau of Investigation Criminal Justice Information Services (“FBI CJIS”) background checks.

3.2.9 Performance Metrics and Service Level Agreements (SLAs) (Scored)

Proposer shall submit its proposed performance metrics and SLAs.

3.2.10 Price Proposal (To be scored in later round)

Proposer shall complete and submit Attachment E, Price Proposal.

3.2.11 References (Scored)

Proposer shall provide a minimum of three (3) references using Attachment D, Reference Check Form. Reference Check Forms must be completed by an NDR Solution reference, returned to the Proposer, and submitted with the Proposal. NDR Solution References must be from customers for whom Proposer has provided a similar NDR Solution to within the past three (3) years. The State prefers references from governmental customers and references from projects that demonstrate similar size of this project.

In addition, DAS PS may check to determine if references provided support Proposer’s ability to comply with the requirements of this RFP. DAS PS may use references to obtain additional information, or verify any information needed. DAS PS may contact any reference (submitted or not) to verify Proposer’s qualifications.

https://www.oregonlegislature.gov/bills_laws/ors/ors646a.html https://www.oregon.gov/das/Policies/107-004-140.pdf https://www.oregon.gov/eis/cyber-security-services/Documents/eis-css-statewide-information-technology(IT)-control-standards.pdf https://www.oregon.gov/eis/cyber-security-services/Documents/eis-css-statewide-information-technology(IT)-control-standards.pdf http://www.oregon.gov/das/policies/107-004-150.pdf

NDR RFP #S-10700-00010923 Page 16 of 45

3.2.12 Underlying Agreements (Not Scored)

Proposer will submit any additional documents required for this project (e.g., End User License Agreement (EULA), Maintenance Agreement, SLAs, etc.).

3.2.13 Value-Added Services (Not scored)

If Proposer is proposing any value-added services, Proposer shall include a statement describing these services. Proposer may submit services including NDR Solution engineering, installation, configuration, training and maintenance/support, the corresponding prices and subcontractors and/or resellers available to provide said services.

3.2.14 Sample Contract (Attachment A) (Not Scored)

Proposer may submit suggested changes to the Sample Contract. Redlines indicating any desired changes in Attachment A, Sample Contract, for the provisions identified as negotiable by Section 5.4.1 of this RFP should be submitted using ‘track changes’ in Microsoft Word.

3.2.15 Disclosure Exemption Affidavit (Pass/Fail)

Proposer shall complete and submit the Attachment B, Disclosure Exemption Affidavit, as part of the Proposal. Submission is required even if Proposer is not identifying confidential or proprietary information and data for nondisclosure. If Proposer is identifying items for nondisclosure as confidential or proprietary, Proposer must specify the reason for the exemption.

Redacted Proposal. If Proposer is identifying items for nondisclosure, Proposer must provide an appropriately redacted copy of the complete, original Round 1 Proposal submissions.

3.2.16 Certified Disadvantaged Business Outreach Plan (Pass/Fail)

Proposer shall complete and submit Attachment F, Certified Disadvantaged Business Outreach Plan.

3.2.17 Responsibility Inquiry (Attachment G) (Pass/Fail)

Proposer shall complete and submit Attachment G, Responsibility Inquiry.

DAS PS must find that Proposer is Responsible in order to award a Contract. DAS PS may, at any time, find a Proposer to be not Responsible and excuse the Proposer from further participation in the RFP process.

3.2.18 Miscellaneous Provisions

Proposer shall include and address all following provisions in Proposal:

NDR RFP #S-10700-00010923 Page 17 of 45

• Testing

• User Acceptance Testing (UAT)

• Stabilization

• Business Continuity Plan

• Transition plan

• Upgrades/enhancements

• Trouble Ticket System

SECTION 4: ROUND 1 SOLICITATION PROCESS

4.1 Public Notice

The RFP and attachments are published in the State of Oregon’s electronic procurement system, OregonBuys at https://oregonbuys.gov/. Documents will not be mailed to prospective Proposers.

Modifications, if any, to this RFP will be made by written Amendment(s) published in OregonBuys. Prospective Proposer is solely responsible for checking OregonBuys to determine whether or not any Amendment(s) have been issued. Amendment(s) are incorporated into the RFP by this reference.

4.2 OregonBuys

4.2.1 All Proposers must be registered in OregonBuys to do business with the State. Registration is free. To create a vendor account, click the blue “Register” button in the top right corner of the OregonBuys website:

https://oregonbuys.gov/bso. For registration assistance, see vendor registration guidance.

4.2.2 PROPOSERS ARE SOLELY RESPONSIBLE FOR ENSURING THEIR VENDOR

INFORMATION IS CURRENT AND CORRECT IN OREGONBUYS. DAS PS WILL

ACCEPT NO RESPONSIBILITY FOR MISSING OR INCORRECT VENDOR

INFORMATION OR ALTERNATIVE ACCESSIBILITY TO AMENDMENT(S),

ATTACHMENT(S), AND EXHIBIT(S).

4.2.3 OregonBuys Assistance. Parties needing assistance with OregonBuys may contact the OregonBuys Helpdesk by telephone at (855) 800-5046 or by email at support.oregonbuys@oregon.gov.

4.3 Pre-Proposal Conference

A pre-Proposal conference will be held at the date and time listed in Section 1.2, Schedule.

Prospective Proposers’ participation in this conference is VOLUNTARY. Prospective Proposers may attend via conference call or Microsoft Teams.

The purpose of the pre-Proposal conference is to:

• Provide additional description of the project;

• Explain the RFP process; and https://oregonbuys.gov/ https://oregonbuys.gov/bso mailto:support.oregonbuys@oregon.gov

NDR RFP #S-10700-00010923 Page 18 of 45

• Answer any questions Proposers may have related to the project or the process.

The pre-Proposal meeting will be held on 8/08/2024, at 2:30 PM Pacific Time.

Conference call in number:

+1 503-446-4951

Find a local number

Conference passcode:

698 551 357#

Conference Microsoft Teams link:

Join the meeting now

Meeting ID: 292 603 330 685

Passcode: YZWYAN

Statements made at the pre-Proposal conference are not binding upon DAS PS. Proposers may be asked to submit questions in Writing.

4.4 Questions/Requests for Clarification

All inquiries, whether relating to the RFP process, administration, deadline or method of award, or to the intent or technical aspects of the RFP must:

• Be delivered to the SPC via an OregonBuys submission and email;

• Reference the OregonBuys bid number;

• Identify Proposer’s name and contact information;

• Refer to the specific area of the RFP being questioned (i.e. page, section and paragraph number); and

• Be received by the due date and time for Questions/Requests for Clarification identified in the Schedule in Section 1.2.

4.5 SOLICITATION PROTESTS

4.5.1 Protests to RFP

Prospective Proposer may submit a Written protest of anything contained in this RFP, including: the RFP process, Specifications, Scope of Services, and the proposed Contract. This is prospective Proposer’s only opportunity to protest the provisions of the RFP, except for protests of Addenda or the terms and conditions of the proposed Contract, as provided below.

tel:+15034464951,,698551357 https://dialin.teams.microsoft.com/6695bda5-c841-4ea8-9531-d54eb9fd5334?id=698551357 https://teams.microsoft.com/l/meetup-join/19%3ameeting_OGY1ZjU4MGMtZGU4NC00NGUzLWE0ZmEtYWIxMDExZDM2OGVm%40thread.v2/0?context=%7b%22Tid%22%3a%22aa3f6932-fa7c-47b4-a0ce-a598cad161cf%22%2c%22Oid%22%3a%22f7058278-6d90-400b-a57e-9bc711ccdde9%22%7d

NDR RFP #S-10700-00010923 Page 19 of 45

4.5.2 Protests to Amendment

Prospective Proposer may submit a Written protest of anything contained in an Amendment.

Protests to an Amendment, if issued, must be submitted by 5:00 p.m. Pacific Time on the second Business Day following the issuance of the Amendment or the date/time specified in the Amendment, or they will not be considered. Protests of matters not added or modified by the respective Amendment will not be considered.

4.5.3 Requirements for Protests:

Protests must:

• Be delivered to the SPC via email copy;

• Reference the OregonBuys bid number;

• Identify prospective Proposer’s name and contact information;

• Be sent by an authorized representative;

• State the reason for the protest, including:

o the grounds that demonstrate how the Procurement Process is contrary to law, Unnecessarily Restrictive, legally flawed, or improperly specifies a brand name; and o evidence or documentation that supports the grounds on which the protest is based.

o State the proposed changes to the RFP provisions or other relief sought.

Protests to the RFP must be received by the due date and time identified in the Schedule.

• Protests to an Amendment must be received by the due date identified in the respective Amendment.

4.6 PROPOSAL DELIVERY OPTIONS

Proposer is solely responsible for ensuring its Proposal is received by the SPC in accordance with the RFP requirements before Opening. DAS PS is not responsible for any delays in mail or by common carriers or by transmission errors or delays, or for any mis-delivery for any reason. A Proposal submitted by any means not authorized below will be rejected. The following delivery options are permitted for this RFP:

4.6.1 Delivery through OregonBuys

Proposal submission should be electronically through OregonBuys at: OregonBuys.gov.

Detailed instructions on how to submit a Proposal can be found at OregonBuys Vendor Formal Solicitation Response.pdf

4.6.2 Alternate Delivery Options

In the event an alternate delivery format is required for Proposal, Proposer shall contact SPC for discussion and determination.

https://www.oregon.gov/das/ORBuys/Documents/OregonBuys%20Vendor%20Formal%20Solicitation%20Response.pdf https://www.oregon.gov/das/ORBuys/Documents/OregonBuys%20Vendor%20Formal%20Solicitation%20Response.pdf

NDR RFP #S-10700-00010923 Page 20 of 45

4.7 PROPOSAL MODIFICATION OR WITHDRAWAL

If a Proposer wishes to make modifications to a submitted Proposal, Proposer must submit its modification in one of the authorized methods listed in Section 4.5, Proposal Delivery Options. To be effective the notice must include the OregonBuys bid number and be submitted to the SPC prior to Opening.

If a Proposer wishes to withdraw a submitted Proposal, it must submit a Written notice signed by an authorized representative of its intent to withdraw to the SPC via email prior to Opening in accordance with OAR 125-247-0440. To be effective the notice must include the OregonBuys bid number.

4.8 PROPOSAL DUE

A Proposal (including all required submittal items) must be received by the SPC on or before Closing. All Proposal modifications or withdrawals must be received prior to Closing.

A Proposal received after Closing is considered LATE and will NOT be accepted for evaluation. A late Proposal will be returned to the Proposer or destroyed.

4.9 PUBLIC OPENING

There will be no public Opening of Proposals. Proposals received will not be available for inspection until after the evaluation process has been completed and the Notice of Intent to Award is issued pursuant to OAR 125-247-0630. However, DAS PS will record and make available the identity of all Proposers after Opening.

4.10 PROPOSAL REJECTION

DAS PS may reject a Proposal for any of the following reasons:

• Proposer fails to substantially comply with all prescribed RFP procedures and requirements, including but not limited to the requirement that Proposer’s authorized representative sign the Proposal.

• Proposer has undisclosed liquidated and delinquent debt owed to the State or any agency, board, commission, department or division of the State.

• Proposer fails to meet the responsibility requirements of ORS 279B.110.

• Proposer makes any contact regarding this RFP with State representatives such as State employees or officials other than the SPC or those the SPC authorizes, or inappropriate contact with the SPC.

• Proposer attempts to inappropriately influence a member of the Evaluation Committee.

• Proposal is conditioned on DAS PS’ acceptance of any other terms and conditions or rights to negotiate any alternative terms and conditions that are not reasonably related to those expressly authorized for negotiation in the RFP or Amendment.

4.11 ROUND 1 EVALUATION PROCESS

NDR RFP #S-10700-00010923 Page 21 of 45

4.11.1 Responsiveness and Responsibility Determination

4.11.1.1 Responsiveness determination

A Proposal received prior to Closing will be reviewed to determine if it is Responsive to all RFP requirements including compliance with Section 3.2, Round 1 Proposal Requirements section. If the Proposal is unclear, the SPC may request clarification from Proposer.

However, clarifications may not be used to rehabilitate a non-Responsive proposal. If the SPC finds the Proposal non-Responsive, the Proposal may be rejected, however, DAS PS may waive mistakes in accordance with OAR 125-247-0470.

4.11.1.2 Responsibility determination

DAS PS will determine if an apparent successful Proposer is Responsible prior to award and execution of the Contract. Proposer shall submit a signed Attachment G, Responsibility Inquiry, with the Proposal. At any time prior to award, DAS PS may reject a Proposer found to be not Responsible.

4.11.2 Evaluation Criteria

Each Proposal meeting all Responsiveness requirements will be independently evaluated by members of an Evaluation Committee. Evaluation Committee members may change, and DAS PS may have additional or fewer evaluators for optional rounds of competition. Evaluators will assign a score for each evaluation criterion listed below in this Section 4.11.2 up to the maximum points available as specified in Section 4.12 (Point and Score Calculation).

SPC may request further clarification to assist the Evaluation Committee in gaining additional understanding of Proposal. A response to a clarification request must be to clarify or explain portions of the already submitted Proposal and may not contain new information not included in the original Proposal.

The Proposals will be scored as follows for Round 1:

4.11.2.1 Experience and Capabilities (100 Points)

Does Proposer demonstrate sufficient experience in providing the Services and Capabilities including the Project Samples?

4.11.2.2 Staffing Plan, Key Persons, Organizational Chart and Subcontractors (50 Points)

Degree to which Proposer provides a sufficient number of Key Persons and support personnel qualified by experience, credentials and capabilities to deliver the requested services.

4.11.2.3 Proposer Organizational Profile (50 Points)

Degree to which Proposer demonstrates how the organization can effectively deliver the Services described in this RFP.

NDR RFP #S-10700-00010923 Page 22 of 45

4.11.2.1 Scope of Services (250 Points)

Degree to which Proposer meets and describes all requirements of the Project as described in this RFP.

4.11.2.2 Sample Implementation Plan (100 Points)

Degree to which Proposer provides a sample implementation…