NDR RFP Round 2 QA_S-10700-00010923_FINAL_12122024.pdf

NDR RFP S-10700-00010923 Round 2 Questions and Answers (answers provided in bold):

1. Amendment 4, section 4.16.4.8 defines CTI as Computer Telephony Integration. However, the context of this section implies CTI likely stands for Cyber Threat Intelligence. Could the State please clarify whether CTI stands for Computer Telephony Integration or Cyber Threat Intelligence in this scenario?

CTI is Cyber Threat Intelligence.

2. For the Proof of Value NDR Installation the week of December 16: Does the State have a preference as to on-site or remote installation?

There is no POV NDR installation the week of December 16 – just a live demonstration by each vendor of the functionalities of its proposed solution. The POV NDR installation is being scheduled for January 2-3, 2025. Devices should be delivered to the State Data Center the week of December 30th. NOTE: January 1st is a holiday.

Preference is for remote installation. The State Data Center is a secure area. Considering this is a short-term POV evaluation period, the State wishes to avoid having any vendor representative complete the required CJIS background checks (required to enter the State Data Center) – which would delay this procurement process further.

3. During the Proof of Value, how does the State want the proposer to provide technical assistance to ensure all the Attachment I functionalities are fully assessed?

The State will need a technical contact that the evaluation team may reach out to for technical assistance during the POV evaluation period.

4. We understand we will deploy in 3 different on-premises locations within the State Perimeter and Internal Border Locations. Can you specify the names of each location, provide the correct shipping address for each location, and provide a contact at each location for receiving the equipment?

For the POV evaluation, the State is requesting only one device to deploy within the State Data Center Services facility.

Shipping address:

Oregon State Data Center Attention: Tim Lacey/Brian Goergen

530 Airport Rd SE, Salem, OR 97301

5. Do these locations have the ability to rack, stack, power and provide basic IP Configuration with our remote assistance or do you require physical personnel on site for the installation from the vendor? We want to be onsite if possible.

Yes. The State Data Center can rack, stack, power, and provide basic IP configuration with remote assistance from the vendor. Considering this is a short-term POV evaluation period, the State wishes to avoid having any vendor representative complete the required CJIS background checks (required to enter the State Data Center) – which would delay this procurement process further.

6. Will the evaluation cover a single class B environment or multiple?

The State Data Center manages multiple class B public networks and all RFC 1918 addresses.

This evaluation will cover all network traffic that converges through the State Data Center.

7. What are the specific physical interfaces and speeds required for each sensor in each location?

• RJ45 1 GbE Copper

• SFP+ 10Gbps SR

• SFP+ 10Gbps LR

• SFP28 10Gbps/25Gbps

• QSFP 40Gbps

• QSFP28 100Gbps

There will only be one sensor deployed for this evaluation round. It will be located at the State Data Center. The sensor will be connected to a Broadcom Gigamon QSFP 40Gb port.

These will be fiber connected. Vendor should send a GBic with their equipment.

8. Will each deployed sensor only monitor a single mirror or will any of the sensors use two mirrors simultaneously? Please specify which location, specific interface & speed, for each location leveraging more than a single mirror (SPAN).

For the POV evaluation, the deployed sensor will only monitor via a single 40Gb Gigamon port.

9. Question regarding Amendment #4 4.15 A:

An Online Scripted Demonstration hosted by Proposer (i.e., via MS Teams, Zoom, etc.).

Webinar hosting and all other related costs will be at Proposer’s expense. The scripted Network Detection and Response (NDR) Solution should be demonstrated in a navigable NDR Solution system environment similar to the proposed solution and not a slide or PowerPoint style of presentation with screen shots. See Sections 3 through 5 for additional information.

10. I understand that the demonstration of our solution must be live, with us going through the UI in real-time. My question is, can we use PowerPoint slides to address some categories, including AI, support, implementation, etc.? We can talk through it, but it’s easier and more clear if we have a visual reference.

The State would like to see the functionality of AI in the product during the demonstration (e.g. use of natural language queries). However, to illustrate certain requirements that are not part of the technology, such as support, implementation, the State is agreeable that these topics may be more of a discussion – which includes a PowerPoint presentation slide.

11. Regarding the hardware we plan to use for the POC, we’re assuming the initial RFP information—40-gig throughput and approximately 90k total devices—will be fully in scope for the evaluation (all of which will be captured at one site, i.e., a switch at one location). If this is correct, we’re ready to shipping the appliances.

There will only be one sensor deployed for this evaluation round. It will be located at the State Data Center. The sensor will be connected to a Broadcom Gigamon QSFP 40Gb port.

These will be fiber connected. Vendor should send a GBic with their equipment.

12. Additionally, based on the RFP cover letter, we have the shipping address as:

1225 Ferry Street, Salem, Oregon 97301-4285, with you as the recipient.

This is NOT correct.

The shipping information is as follows:

Oregon State Data Center Attention: Tim Lacey/Brian Goergen

530 Airport Rd SE, Salem, OR 97301

The contact is Brian Goergen