NDR_RFP_S-10700-00010923_QA_RESPONSES_FINAL.xlsx
XLSX spreadsheet 20 KB Posted
- Attached to
- Network Detection and Response (NDR) Solution
- Solicitation number
- S-10700-00010923
- Issued by
- Marion County, Oregon
About this file
This document is a Request for Proposals (RFP) issued by the Oregon Department of Administrative Services Procurement Services (DAS PS) to procure a Network Detection and Response (NDR) Solution for the state of Oregon. The RFP seeks a SaaS, IaaS, or COTS solution that includes all required equipment, configurations, licenses, portals, training, integrations with current security systems, maintenance, and operations support. The solution is intended to serve approximately 90,000 interconnected devices across the state. Proposals are due by September 6th, and the state anticipates awarding one contract from this RFP.
The RFP provides detailed technical requirements for the NDR solution, including asset management, traffic separation, forensic capabilities, and integration with the state's Microsoft Sentinel instances. The state currently utilizes Tenable for vulnerability management and Defender XDR as its enterprise security platform. The RFP does not specify a pay-as-you-grow pricing model, but the state is open to multi-vendor solutions if the integrations are seamless. The state has a team of approximately 10 people, with 2-3 directly responsible for managing and administering the NDR solution.
View the file
Other files
Show all 22
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1 Network Detection and Response (NDR) Solution Opportunity S-10700-00010923 Questions and Answers
| Question # | RFP Section | Subject | Question | Answer |
| 1 | General | Was the NDR RFP Pre-Proposal Conference recorded? | No | |
| 2 | Paragraph 3.2.16, page 16, and Attachment F, Question 1 | Certified Disadvantaged Business | Will the State accept Disadvantaged Business certification from the US Small Business Administration (SBA) in lieu of certification from Oregon Certification Office for Business Inclusion and Diversity? | No |
| 3 | Paragraph 3.2.4, page 11 | Key Persons | Because key personnel may join or leave a company in the time it takes for proposal evaluation and contract award, can proposers provide sample resumes of Key Persons instead of current resumes? | Current resumes of key personnel must be provided. |
| 4 | Paragraph 3.2.6.4, page 13 | Training | Is there a desired format for instructor-led training, such as virtually with a remote instructor, or an in-person instructor? | Either remote 'live' training or in-person instructor-led training is acceptable. |
| 5 | Paragraph 2.4.2, page 8; and Paragraph 3.2.6.6, page 13 | Ongoing Maintenance and Support | Does the EIS/CSS Agency expect on-site support and maintenance of the NDR system, or can there be remote support with scheduled on-site support visits? | Remote support with scheduled on-site visits are acceptable. |
| 6 | Paragraph 4.15.1, page 25 | Evaluation Round 2 Proof of Value (POV) | Does the Agency intend to have proposers who advance to Round 2 POV provide, implement, and integrate their NDR solution into the State environment during the same 45-day time span as other proposers, or will each proposer perform the POV sequentially for 45 days each? | EIS CSS intends to have each Proposer perform the POV sequentially for 45 days each. |
| 7 | Section 3.2, Round 1 Proposal Requirements | Sample Contract | We are hoping to get some clarification on when redlines to the Sample Contract are due. Section 3.2 “Round 1 Proposal Requirements” includes the Sample Contract redlines in (3.2.14) suggesting that they are due at time of proposal submission, however, section 5.4.1 “Negotiation” states that Sample Contract exceptions must be submitted during the Questions / Requests for Clarification period. | Redlines to the Sample Contract are due at the time of Opening, the date Proposals are due. Please see Amendment No. 1 to the RFP. |
| 8 | General | Is this a stage gate project? | This is not a stage gate project, but still requires oversight, meaning it still has to undergo review and receive formal approvals from P3 and CSS in order to execute. | |
| 9 | General | If we are interested in responding to this RFQ are we still eligible to do so if we missed the voluntary pre-proposal conference on 8/8/24? | To clarify, this opportunity is an RFP, not an RFQ. Prospective Proposers are still eligible to submit a Proposal if they didn't attend the voluntary Pre-Proposal Conference. See Section 4.3 of the RFP. | |
| 10 | General | How much data does your firewalls generate? | The Border and Perimeter firewalls generate, in total, around 4B-17B events per day. | |
| 11 | Attachment H, Line 32: | Is there is a specific cloud environment that this will potentially be run in/needed. | Security alerts/events need to be ingested by Microsoft Sentinel in 8 different Azure tenants. Future planning for AWS and GCP. | |
| 12 | Attachment H, Line 35: | Deception Technology: Solution has the ability to proactively and reactively deploy realistic and dynamic decoys to mislead, detect, and defeat sophisticated cyber-attacks. What is the context here? Are you asking if it deploys a honeynet? | While a honeynet is a deception technology, they tend to be static, one-time use, and no longer sufficient for today's advancing security landscape. We're looking for dynamically and automatically generated, authentic-looking virtual network assets to confuse and delay attackers, and generate very high confidence security alerts. | |
| 13 | NDR RFP, Page 5 | Infrastructure design and the bandwidth, is there any way you can dive deeper into the design? Any data around the architecture and specifics for sizing (rack space, what each location will be looking at from a bandwidth perspective etc.) | Rack space is not an issue. Current bandwidth is 40Gbs. | |
| 14 | Attachment H, Line 10: | The solution is capable of asset grouping and management. What sort of management are you looking for? | Devices by Role would seem appropriate for an NDR solution. However, that may just be one example. | |
| 15 | Attachment H, Line 21: | Able to separate traffic for integration with 8 separate SIEMs (Security Information and Event Management); Seamless integration with 8 instances of Microsoft Sentinel, to provide a comprehensive view of security events across the organization. Our engineering team needs clarification on what exactly is required for “8 SIEMS”. Is SYSLOG what you are looking for on this question? | CSS maintains and manages Azure Sentinel instances in our 8 Commercial/GCC tenants. 7 of these tenants are specific to individual State agencies, while the 8th is a large, shared tenant. Ideally, the solution can both identify traffic belonging to individual agencies AND be able to send logs based on that identification to the appropriate tenant's Sentinel instance. Azure SYSLOG would incur additional costs, but would be an acceptable 2nd alternative. | |
| 16 | Attachment H, Line 23: | Forensic Capabilities: Enable the capture and analysis of historical network data for incident response and forensic investigations. What is required for the Solution to capture and analyze historical network data? How much data can be captured? Is it based upon events? How long can it be retained? What do you mean by historical? Are you asking if data already stored before the service begins can be fed back into XDR after it begins? Or if data in cold storage can be fed back in well after the fact? | Assume no historical ingestion. After systems are put in place, the service must provide at least 90-days of log retention for post-incident investigations; and these logs should be easily exported for 3rd-party review. | |
| 17 | General | Please provide clarification of your AI/ML definitions. CISA, DARPA and the NSA recently recognized the increasing capabilities of advanced cyber threat actors to exploit fundamental vulnerabilities in ML components. ML cyber systems derived from historical data show acute weaknesses and as a result, these federal agencies recommend using definitions which clearly delineate between ML capabilities and AI capabilities | The definitions in the RFP remain unchanged. Here are the definitions pulled from the RFP for ease of reference: |
Machine Learning: A branch of artificial intelligence (AI) and computer science that focuses on the using data and algorithms to enable AI to imitate the way that humans learn, gradually improving its accuracy.
Wizard-style AI: A form of AI which specializes in machine learning reliability within the AI sector and is comprised of a suite of machine learning testing and governance tools designed to produce fair, auditable, transparent, and explainable models, and to mitigate risks in both development and production phases.
Large Language Model AI: A deep-learning algorithm that is trained on immense amounts of data and parameters to provide the foundational capabilities needed to drive multiple use cases and applications, as well as resolve a multitude of tasks. These generative AI-based models are capable of performing various natural language processing tasks beyond simple text generation, including revising and translating content, and are designed to capture intricate language patterns and perform a wide array of language-related tasks.
| 28 | Page 5: Section 2.3.1, Paragraph 4 | Infrastructure Description | Regarding the additional 47,000 interconnected devices, are these BYOD or are they ephemeral nodes within containers? | In addition to the approved interconnected state devices, there are still several agencies utilizing the BYOD |
| 19 | Page 5: Section 2.3.1, Paragraph 5 | Infrastructure Description | Regarding the in-scope locations, is it three locations plus cloud? Or 3 locations including cloud? And does the 36 Gb/s apply to all three and cloud? Can EIS CSS provide a description and illustration of the cloud architecture? How many availability zones / regions / vnets? | 3 physical locations in Salem, OR; plus 8 GCC/Commercial Azure tenants, plus AWS (plus, probably, GCP in the future.) |
| 20 | Page 5: Section 2.3.1, Paragraph 5 | Infrastructure Description | Is it possible to have a live architecture session with the EIS CSS team before the proposal submission deadline, so our team can better understand the existing infrastructure beyond what is shown in the RFP? | The state will be planning an architecture session for 2nd round. |
| 21 | Page 7: Section 2.4.2. All bullet points | Deliverables | Are these deliverables required if the proposed NDR solution is a COTS product deployed in SaaS environment? Some of the deliverables are more typical of application development projects. Can we respond with those deliverables that we would consider to be in scope based on the proposed platform and deployment type and note which deliverables would be out of scope? | All functionalities marked 'Mandatory' are required to be met by the solution. All functionalities marked 'Desireable' are optional value-added options. |
| 22 | Page 8. Section 2.4.3 and Attachment H. Line 10 | Asset Management | Regarding "The solution is capable of asset grouping and management". What does ODAS mean by "Asset Management" in the context of NDR functionality, which is different than asset grouping? | For this RFP, and in the context of NDR functionality, the state recognizes 'asset grouping' as a better term. |
| 23 | Page 10. Section 3.1.2. Paragraph 1 | Page Limit | Regarding the 20 page limit for proposals, is it acceptable for vendors to include hyperlinks to supporting documentation? | The state evaluation team is restricted from conducting research. Evaluations are limited to what is contained in the proposal. |
| 24 | Page 30. Sections 5.4.1 and 1.2. Paragraph 3 and line 3 | Sample Contract | Can DAS PS extend the deadline for submitting exceptions to the Attachment A - Sample Contract from August 15th to the proposal submission deadline of September 6th? | See answer to Question #7, above. |
| 25 | Section 5.4.1 of the RFP (Page 30) / Section 3.2.14 (Page 16) | Sample Contract | Can DAS PS clarify if vendors are to provide exceptions to the sample contract during the Q&A period or can we provide with our proposal, per Section 3.2.14 (Page 16)? Due to the length of the contract document, if the DAS PS prefers exceptions to be submitted during the Q&A period, we respectfully request an extension of the Q&A deadline to allow additional time to thoroughly review the sample contract and provide exceptions if necessary. | See answer to Question #7, above. |
| 26 | Page Limit | Will DAS PS consider increasing the page limit to allow adequate space to thoroughly answer questions in the RFP? | The state is limiting page limit for several reasons: |
Consistency and Fairness: A strict page limit ensures that all vendors are evaluated on an equal footing and that no vendor is disadvantaged by providing a more concise proposal. It also prevents overwhelming the evaluation team with excessively long proposals.
Focus on Key Information: A page limit forces vendors to focus on the most critical aspects of their solution, rather than including unnecessary details. This can help ensure that the proposals are concise, focused, and easier to review.
Efficiency for Evaluation: Reviewing RFP proposals can be time-consuming, especially if there are many submissions. Limiting the number of pages helps ensure that the evaluation process remains efficient and manageable.
27 Page Limit Can DAS PS clarify whether the following documents will be counted in the page limit?
o Sample Contract / exceptions o Organizational Chart o Cover, Cover Letter, Table of Contents o Proof StateRAMP status / Security Snapshot Score Sample Contract/exceptions: No Organizational Chart: No Cover, Cover Letter, Table of Contents: No Proof of StateRAMP status/Security Snapshot Score: No 28 General After reviewing the Oregon DAS RFP for us to properly provide all of the requested security information is the state able to sign the attached MNDA? The State of Oregon is not signing MNDAs at this time for this RFP. See following sections in RFP:
Section 6.4 Section 3.2.15 Section 3.1.3
| 29 | general | How does the SOC team use packet capture today? How will packet capture be leveraged in the future, post-solutioning of the NDR project. | The SOC does not currently utilize packet capture and have very limited NetFlow (QNI) capability. |
| 30 | general | How does the SOC team investigate security incidents on systems that cannot be managed with agents (e.g. IOT, OT, etc.)? | Defender XDR is the enterprise platform, but EIS CSS do not yet use the Defender for IOT component. |
| 31 | general | How does the State identify and remediate vulnerabilities on systems that cannot be "scanned" or where traditional vulnerability management agents cannot be installed? | Tenable is the enterprise standard. Vulnerability information is additionally available through Defender XDR. |
| 32 | general | What vulnerability scanner(s) does the State use today? | Tenable. |
| 33 | general | How does the SOC detect unmanaged or rogue assets on the network? | The SOC do not have detection for the simple existance of unmanaged/rogue devices, but, if those devices are involved in security alerts with managed devices, Defender XDR/Azure Sentinel is the alerting and investigation platform. |
| 34 | general | What is the typical investigative workflow today following a detection event for an unrecognized device operating within one of the downstream agencies operating on the state network? | After initial triage and investigation, if EIS CSS cannot identify the assets involved and the behavior alerted upon, notifications are sent to agencies for additional investigation. These agencies are then required to report their findings and conclusions back to EIS CSS for alert resolution. |
| 35 | general | What Endpoint Detection & Response (EDR/XDR) solutions are used by the State today? How important is it for the NDR solution to work in concert with those other EDR technologies? | Defender XDR. While it's not important for the NDR solution to work directly with Defender XDR, it's vital that the NDR solution provide additional alerting and correlation within Azure Sentinel. |
| 36 | general | The RFP scope suggests approximately 90k assets operate on the network. How was that number determined? | This is derived from the State of Oregon's XDR asset inventory. |
| 37 | general | Does the State have a way today of identifying and categorizing assets operating on the network, regardless if they are managed (agented) assets? | Yes, but only on network segments where Defender XDR-managed devices also reside. Tenable also performs asset discovery. |
| 38 | general | In the RFP, we noticed that Vulnerability scoring along with device business criticality scoring wasn't mentioned as part of influencing the NDR solution's decisions for taking action. Is prioritizing remediation based on criticality and actual business impact important to the State as a part of this project? | Yes. Any value added options that provide the State the ability to prioritize remediation, based on criticality and actual business impact is important to the State. It would be beneficial to understand how the NDR solution's vulnerability scoring with device business criticality compares to those products already in use by the State that offer the same features (e.g. Tenable) |
| 39 | general | How does the State apply policies (for example, enforcement, containment, etc.) to unmanaged, un-agented assets today? | Enforcement is managed by each IT department within the executive branch. Containment may be achieved through the State's XDR solution. The state is interested in how an NDR solution could fill the void where the State's XDR solution isn't present. |
| 40 | general | Is un-agented asset visibility important where vulnerability scanners are not allowed/permitted? | Yes |
| 41 | general | How does the State ensure consistent policy enforcement across all device types? | This question is vague as there are many different types of policies (e.g. conditional access policies, device policies, group policies). Each agency manages their own device (servers, workstation ) policies. |
| 42 | general | What are the general response times required for reporting asset information? What about Vulnerability information? | Real time or near real time would be preferable. This will support contextual awareness and automated actions. Support for scheduled scans or periodic updates will help to refresh asset inventory for asset information that doesn't require immediate updates. |
| 43 | general | Approximately how large is the team supporting this solution? | The entire team is 10 people, but the duties are also spread. The direct team that will be managing and administering this solution would be in the number of two or three. |
| 44 | general | Is there an interest from the State for a solution that is co-managed by a 3rd party service provider and/or a dedicated remote engineer from the involved vendor(s)? | The State is first looking for a solution that will meet all of the functionality requirements. Co-managed solutions, and/or a dedicated remote engineer, may add additional costs that are outside of the budget for this RFP. |
| 45 | general | Where a solution may have a gap, is a multi-vendor solution acceptable? If so, is tight integrations between those systems a priority? | The State will prioritize solutions that meet all of the requirements. If no solutions exists that meet all of the requirements, multi-vendor solutions may be acceptable so long as the integrations are seemless and don't add additional complexity. |
| 46 | general | Is the State interested in a pay-as-you-grow model in lieu of an upfront capital expenditure, where the cost of the solution will rise with the number of assets observed and protected? This option is popular with many centralized operations pursuing whole-of-state solutioning for the purpose of aligning costs to each responsible agency. | A 'pay-as-you-grow' model described in the question is not being applied for this RFP. |
| 47 | general | How soon does this solution need to be in production and providing all requested capabilities? | The State is working to have a solution in place by spring 2025 |
File details come from the government source that posted it. Updated .