Q&A_and_Addendum_No_3 posted_08-27-25.pdf

MyFloridaNet-3 Core Services Invitation to Negotiate

No. DMS-24/25-260

Questions and Answers and

Addendum No. 3

Questions and Answers

The Department has received the following questions through MFMP Sourcing, and the Department’s answers are provided in the table listed below:

No. Question Answer

1 Just received the below message saying the due date has been pulled forward to July 23. I pulled the latest info from VIP and the timeline of events is the same. Is the below message a mistake?

Id: MSG192202001 Sent: 06/25/2025 10:46 AM Subject: Event MyFloridaNet-3 Core Services - ITN has been reduced by 47 days 6 hours 12 minutes.

Ariba event Doc1594801249 MyFloridaNet-3 Core Services - ITN has been reduced by 47 days 6 hours 12 minutes.

The start time is Wednesday, June 25, 2025 at 10:48 AM, Eastern Daylight Time.

The end time is Wednesday, July 23, 2025 at 7:48 AM, Eastern Daylight Time.

To view the changes, please access https://myfloridamarketplace.supplier3.ariba.com/ad/webjumpe r?itemID=NY9yAPjCAKd%21mct&awcharset=UTF-8. After you log on, you will see the updated close time.

If you have any questions about the event, please contact Christia Nunnery at or via e-mail at christia.nunnery@dms.fl.gov Thank you, MyFloridaMarketPlace

The deadline for Respondents to submit a Reply and all required documents in the Business Network has not been changed. The Ariba system notif ication was a result of internal adjustments made to the status of the sourcing event on 6/25/2025, which was shortly reverted to align with the Reply deadline of 09/08/2025 at 2:00PM ET.

Please note that any modifications to the solicitation, including revision to the 'Timeline of Events,' will be issued by the Department via addenda posted on the Vendor Information Portal (VIP) in accordance with Section 2.3, Addenda to the Solicitation, of the MyFloridaNet-3 Core Services Invitation to Negotiate document (_MFN- 3_ITN_Core_Services_DMS -2425-260_v2). It is the responsibility of the Respondents to check VIP for information and updates throughout the solicitation process and prior to submitted a Reply.

2 Document Reference:

Tab 11, Lines 3398-3420 of Attachment K - Cost Reply Price Workbook -

Some of the milepost locations appear to be weigh stations, rest areas, or service plazas. Please provide lat/long information for these sites for better accuracy.

This information is not available from DMS.

However, this information can be obtained via online tools or lookups (e.g., Maps applications, GIS programs, etc.).

3 Document Reference:

Section 3.B.7 of Attachment B - Draft Contract:

Will contractors be provided an ideal invoice layout prior to contract execution to determine if the following requirement can be met, "The Contractor shall submit invoices for services in detail sufficient enough for a proper pre-audit and post-audit."?

The Department can provide the required fields and recommended layout after contract execution.

4 Document Reference:Attachment A - Statement of Work - For the site list with multiple circuits/services at a single address, is the Department of Management Services (DMS) incorporating new equipment that would be able to segregate services based on EVCs/IPs to offer a cost savings on the access transport?

The Department does not contemplate this in the MyFloridaNet-3 (MFN-3) Core Services Invitation to Negotiate (ITN).

5 Document Reference:

Attachment A - Statement of Work:

For sites that currently have legacy telecom services (i.e. DS1, DSL, etc.), can DMS accept an Ethernet handoff that standardizes delivery across all sites?

This question is not applicable to the MFN-3 Core Services ITN.

6 Document Reference:

Attachment K - Cost Reply Price Workbook (LEO 40Gb & 1Tb sites):

The sites listed as LEO access methods are listed as large bandwidth currently (40Gb & 1Tb). Can DMS provide additional insight into the function or type of site this is to better assess fiber construction into these sites?

40GB and 1TB are monthly data plans, not bits per second circuit sizes. The information (40Gb; 1Tb) provided in Tab 11 (Column H, LEO Capacity) of Attachment K, Cost Reply Price Workbook v3 is the Low Earth Orbit (LEO) Satellite Capacity monthly data plan. This is satellite service for remote/rural areas. There is no need to assess fiber construction as the service is provided by satellite.

7 Document Reference:

Section 13.A(e) of Attachment B - Draft Contract:

Are there minimum requirements for the risk assessments, penetration testing, and vulnerability scans required in this section? Please elaborate.

In accordance with Section 13, Data Security, of Attachment B-Draft Contract, the requirement applies to State of Florida data collected by, created for, or provided by the Department or Customers. There are no minimum requirements for frequency; however, data security must be maintained at all times.

8 Document Reference:

Section 19 of Attachment B - Draft Contract:

Who is eligible to be an authorized representative in regards to providing this annual affidavit?

Please refer to Addendum No. 2 and Section 1.A., Definitions, of Attachment B- Draft Contract v3 for the definition of "Authorized Representative." Any member of the Contractor's organization that meets this definition would be eligible.

9 Document Reference:Section 2.14 of Attachment A - Statement of Work: SASE (Secure Access Service Edge). Can DMS estimate a user count for the SASE solution?

The Department does not have any historical data, as this would be a new offering.

10 Document Reference:

Section 2.13 of Attachment A - Statement of Work:

Are there any other security compliance requirements that need to be taken into account other than FIPS 140-2? Please elaborate.

Yes. The Core Services Provider (CSP) must comply with the State of Florida security policies. Please refer to Section 2.17.2 of Attachment A-Statement of Work v3.

11 Document Reference:

Section 2.13 of Attachment A - Statement of Work:

Is there a requirement for SD-WAN Orchestration to be at a private datacenter within the MyFloridaNet-3 core or Fedramp Cloud Service Provider? Please provide details.

There are no specific requirements for the Software-Defined Wide Area Network (SD-WAN) Orchestration to be placed at a private data center within the MyFloridaNet-3 core or Fedramp Cloud Service Provider. However, Section 1.1, Introduction, of Attachment A-Statement of Work v3 states that all equipment, systems, and services shall be dedicated, owned, and managed by the CSP unless stated otherwise.

12 Document Reference:

Section 2.10 of Attachment A - Statement of Work:

Are there any requirements for hardened SD-WAN equipment that would reside in outdoor and/or unconditioned space? If so, please provide details regarding anticipated location types.

This type of equipment can be made available using the Customer Premises Equipment (CPE) rental formula. Please refer to Section 2.10.1(f) of Attachment A-Statement of Work v3 and Attachment K- Cost Reply Price Workbook v3 (CPE tabs). No information on the location types is available.

13 Document Reference:

Section 2.7.15 of Attachment A - Statement of Work:

What percentage of circuit usage for Multicast traffic is anticipated? Also what specific protocol support is required?

i) Protocol Independent Multicast (PIMv2/PIM-SM/PIM-SSM)

ii) PIM Boot Strap (BSR)

iii) IGMP v2/v3

iv) IGMP v2/v3 Snooping and Snooping Querier

v) Bi-Directional PIM (PIM BiDir)

vi) Anycast RP

vii) Multicast Source Discovery Protocol (MSDP)

viii) Static Multicast Routing (Static Route)

There is no information available for the circuit usage of multicast traffic as the Department does not track this.

There are no minimum requirements related to the specific protocols. However, Section 2.7.15, Multicast Functionality, of Attachment A - Statement of Work v3 instructs Respondents to describe the proposed Multicast functionality and the manner in which the functionality will be provided.

14 Document Reference: Section 2.8.6 of Attachment A - Statement of Work: Will DMS provide their Change of Control Process document for Core Services Providers to follow prior to execution of contracts?

Please see Section 2.8.6, Maintenance Notif ications and Change Control Processes, of Attachment A- Statement of Work v3. The Respondent is expected to propose a change control process based on the requirements of the Statement of Work.

15 Document Reference:

Section 2.7.12 of Attachment A - Statement of Work:

Will DMS require any other access methods other than those listed in Section 2.12 of Attachment A?

Please see Section 2.12.1, Strategies to Promote and Incorporate Access Providers, of Attachment A- Statement of Work v3.

16 Document Reference:

Section 2.10.3 of Attachment A - Statement of Work:

If equipment is released for sale by the equipment manufacturer and does not pass certif ication processing/ testing by the Core Services Provider, must it still be supported by the Core Services Provider for maintenance and error corrections? Does this also include Section 2.17.32 of Attachment A?

Per Attachment A-Statement of Work v3, Section 2.10.3, Customer Premises Equipment Roadmap, "As equipment is released for sale by equipment manufacturers it becomes a candidate for inclusion in the equipment supported by the Core Services Provider, but it does need to pass the Core Services Provider’s certif ication process for testing and field availability."

Equipment that does not pass the certif ication process will not be approved for Customer use; therefore, Section 2.17.34 (formerly Section 2.17.32) of Attachment A-Statement of Work v3 would not be applicable to the second question.

17 Document Reference:

Section 2.11.15 of Attachment A - Statement of Work:

Does the End-to-End Integration Responsibility for the Services Providers include Customer-Managed CPE Configurations as referenced in 2.10.6 of Attachment A?

Yes. End-to-End Integration Responsibility for the Services Providers includes Customer-Managed CPE Configurations as referenced in Section 2.10.6 of Attachment A, Statement of Work, v3.

18 Document Name:

_MFN-3_ITN_Core_Services_DMS-2425-260.pdf Section: 2.2 Page: 10 Question:

Will respondents be permitted to ask follow up questions to responses or to ask additional clarifying questions as our solution evolves? Will the State allow for a second round of questions?

The Department will not conduct a second question and answer period during the evaluation phase of the ITN. Additional clarifying questions may be discussed during the negotiation phase.

19 Document Name:_MFN-3_ITN_Core_Services_DMS-2425- 260.pdf Section: 1.2 Page: 4 Question #1 of 2:Will the Contractor be required to transfer hardware assets, software assets, and maintenance contracts for hardware and software assets from the Incumbent Contractor?

Question #2 of 2:If the answer to question #1 is "Yes," how will the assets be valued (e.g., Net Book Value, Fair Market Value)?

No, the Contractor will not be required to transfer hardware assets, software assets, and maintenance contracts for hardware and software assets from the incumbent Contractor.

20 Document Name:

_MFN-3_ITN_Core_Services_DMS-2425-260.pdf Section: 1.2 Page: 4 Question #1 of 2: Will the Contractor be required to transfer hardware assets, software assets, and maintenance contracts for hardware and software assets from DMS and/or other DMS approved stakeholders?

Question #2 of 2: If the answer to question #1 is "Yes," how will the assets be valued (e.g., Net Book Value, Fair Market Value)?

No, the Contractor will not be required to transfer hardware assets, software assets, and maintenance contracts for hardware and software assets from DMS and/or other DMS approved stakeholders.

21 Document Name:

Attachment A-Statement of Work.pdf Section: Table 6: Component Management Responsibilities Page: 117 Question:

In the matrix, the CSP is listed as responsible for TSP Management, Daily Operational Management and NOC and SLA Scrubbing. How is the CSP expected to gain visibility to the TSP services to perform those functions?

Section 2.3, General Requirements, of Attachment A-Statement of Work v3 asks Respondents to propose a solution based on the requirements of Table 6 and Section 2.3.6, Core Services Provider, of Attachment A-Statement of Work v3. Specific processes will be dependent upon the agreed upon solution and configuration of the awarded

CSP.

22 Document Name:Attachment A-Statement of Work.pdf Section: 2.4.4 Enterprise Security Information Event Manager Tool:

Page: 38 Question:The ITN requirement states: "Directing all f irewall logging to the Enterprise Security Information & Event Manager (SIEM)." Is the Contractor required to direct the logs from firewalls that are not managed by the Contractor to the Contractor's SIEM?

Yes. Please refer to Section

2.3.11 of Attachment A- Statement of Work v3. The Contractor is required to receive logs into the Contractor's Enterprise Security Information & Event Manager (SIEM) from customer managed firewalls.

23 Document Name:

Attachment A-Statement of Work.pdf Section: 2.4.12 Mitigation of DoS Attacks Page: 42 Question:

Is the Contractor authorized to propose a Distributed Denial of Service (DDoS) solution inclusive of scrubbing devices that are hosted in the Continental United States (CONUS) and Outside of the Continental United States (OCONUS)?

The Distributed Denial of Service (DDoS) solution inclusive of scrubbing devices must be hosted in the Continental United States (CONUS). Please refer to Section 2.4.3, Security Operations Center, of Attachment A-Statement of Work, v3.

24 Document Name:

Attachment A-Statement of Work.pdf Section: 2.7.1.a Page: 63 Question:

Can the State define uptime in relationship to weather and uncontrolled events?

The same uptime in Section 2.7.1.a of Attachment A- Statement of Work v3 shall apply. However, any uptime calculations or Service Level Agreements (SLAs) impacted due to Force Majeure may be exempt per Section 5.n. Force Majeure, Notice of Delay, and No

Damages for Delay, Exhibit 3 - PUR 1000 upon DMS approval.

25 Document Name:

Attachment A-Statement of Work.pdf Section: 2.7.1.h Page: 64 Question:

Does the State have a current DNS vendor and is it the intention of the state that the CSP vendor would replace that solution, or take that solution over? Can the State tell us who that DNS vendor is?

Domain Name System (DNS) is not within the scope of the MFN-3 ITN. Under MFN-3, DNS services will be provided by the Department's Division of Telecommunications.

26 Document Name:Attachment A-Statement of Work.pdf Section: 2.7.20 Page: 74 Question:Is this limited to data center deployed hardware or does the State expect all hardware deployed for the solution have redundant power and generator power?

Please refer to Section 2.7.20, Power Supply, as a component of High Availability and High Reliability, of Attachment A- Statement of Work v3. The Core Services Provider is to provide backup power supply to core facilities.

27 Document Name:

Attachment A-Statement of Work.pdf Section: 2.7.18.c Page: 72 Question:

Does the State have a 2, 3 and 5 year projected network traffic plan? If so can that be released as far as projected traffic growth.

The Department does not have a projected network traffic plan.

28 Document Name:

Attachment A-Statement of Work.pdf Section: 2.17.33 Page: 134 Question:

Will the State share their current and projected bandwidth requirements for the next two to four years?

For current bandwidth requirements, please refer to Attachment K-Cost Reply Price Workbook v3.

Projected bandwidth requirement is not available, as this is determined by the Customer.

29 Document Name:

Attachment A-Statement of Work.pdf Section: 2.4.1.1-7 Page: 32 Question:

Will the State provide the name of the current Firewall vendor or is this the CSP providers choice as to which firewall is deployed?

It's CSP's choice as long as it meets the criteria in Section 2.4.1, Enterprise Firewall Functionality, of Attachment A - Statement of Work, v3.

30 Document Name:

Attachment A-Statement of Work.pdf Section: 2.8.22 Page: 89 Question:

Will the State release the critical systems as a response to questions?

The question is not clear; no critical systems are referenced in Section 2.8.22, Proposed SLA Performance Monitoring Service Functionality, of Attachment A-Statement of Work v3.

31 Document Name:Attachment A-Statement of Work.pdf Section: 2.4 Page: 31-34 Question:Events Per Second (EPS): What is the average EPS (Events Per Second) that the current infrastructure generates?

This question is not clear.

32 Document Name:

Attachment A-Statement of Work.pdf Section: 2.4 Page: 31-34 Question:

Can you provide a breakdown of EPS or GB//day by device type (e.g., servers, f irewalls, network devices, endpoints, applications)?

This information is not currently tracked by the Department.

33 Document Name:

Attachment A-Statement of Work.pdf Section: 2.4 Page: 31-34 Question:

Events Per Second (EPS)/Gigabyte (GB) per day: What is the peak EPS and/or daily log ingest in GB per day observed, and for what duration do these peaks typically last?

This information is not currently tracked by the Department.

34 Document Name:

Attachment A-Statement of Work.pdf Section: 2.4 Page: 31-34 Question:

How does the current SIEM handle bursts or spikes in event volume?

This information is not currently tracked by the Department.

35 Document Name:

Attachment A-Statement of Work.pdf Section: 2.4 Page: 31-34 Question:

How does the incumbent SIEM solution handle log compression?

This information is not currently tracked by the Department.

36 Document Name: Attachment A-Statement of Work.pdf Section: 2.4 Page: 31-34 Question: Please provide the total quantity of unique log sources that provide logs to the Security Information and Event Management (SIEM) platform (e.g., servers, f irewalls, network switches, cloud instances, applications, etc.). The ITN references log sources that from the enumerated list below:

(1.) Internet complex firewalls with unified threat prevention(2.)

MFN-3 core router system logs, and flows (IPFIX, NetFlow v9, J-flow)(3.) MFN-3 CPE and firewall system logs, including both allow and deny logs(4.) MFN-3 Managed Security Services logs(5.) MFN-3 tools and their related systems

Please refer to Section 2.4, Wide Area Network Enterprise Security Services, of Attachment A-Statement of Work v3. All MFN-3 devices that are capable of creating log information must be sent to the SIEM platform. Total quantities are not available.

37 Document Name:

Attachment A-Statement of Work.pdf Section: 2.4 Page: 31-34 Question:

Please describe any technical or non-technical constraints with the Incumbent SIEM that is resolved by customizations and/or manual procedures for specific log sources or the data types from specific log sources.

An example of technical constraint is a a log source that requires the creation of a custom parser that is not supported by an Original Equipment Manufacturer (OEM). An example of a non-technical constraint is a when a mandatory policy and procedure exists that requires touch labor personnel to perform an onsite visit to a facility to manually download logs from a server that is hosted on air-gapped network, and then manually upload the logs to the SIEM.

This information is not currently tracked by the Department

38 Document Name: Attachment A-Statement of Work.pdfSection: 2.4 Page: 31-34Question: Number of Users: How many active users will be monitored?

This information is not yet available for MFN-3.

39 Document Name:

Attachment A-Statement of Work.pdf Section: 2.4 Page: 31-34 Question:

Number of Endpoints: How many endpoints (workstations, laptops, mobile devices) will contribute logs?

The number of endpoints that meet these example types (work stations, laptops, mobile devices) and that contribute logs is zero.

40 Document Name:

Attachment A-Statement of Work.pdf Section: 2.4 Page: 31-34 Question:

Cloud Data Sources: For cloud environments (AWS, Azure, GCP), what specific services will generate logs (e.g., CloudTrail, VPC Flow Logs, Azure Activity Logs, Kubernetes audit logs)?

The Department does not contemplate this in the MFN- 3 Core Services ITN.

41 Document Name:

Attachment A-Statement of Work.pdf Section: 2.4 Page: 31-34 Question:

Cloud Data Sources: What is the estimated daily volume of logs from each cloud service?

The Department does not contemplate this in the MFN- 3 Core Services ITN.

42 Document Name:

Attachment A-Statement of Work.pdf Section: 2.4 Page: 31-34 Question:

Cloud Data Sources: How many cloud tenants, accounts, or subscriptions need to be monitored?

The Department does not contemplate this in the MFN- 3 Core Services ITN.

43 Document Name: Attachment A-Statement of Work.pdfSection: 2.4 Page: 31-34Question: Application- Specific Logs: For critical business applications (e.g., ERP, CRM, custom applications), what is the estimated EPS/GB per day from each, and what level of granularity are we looking to capture?

This metric is not currently tracked by the Department.

44 Document Name:

Attachment A-Statement of Work.pdf Section: 2.4 Page: 31-34 Question:

Application-Specific Logs: How many discreet instances of these applications will be sending logs?

This will be dependent upon the agreed upon solution and configuration of the awarded CSP.

45 Document Name:

Attachment A-Statement of Work.pdf Section: 2.4 Page: 31-34 Question:

Retention Period: What are the required retention periods for different types of logs (e.g., 90 days for hot storage, 1 year for warm, 7 years for cold/archival)?

36 months. Please refer to Section 2.8.20, Proposed Logging and Archival Process, of Attachment A- Statement of Work v3.

46 Document Name:

Attachment A-Statement of Work.pdf Section: 2.4 Page: 31-34 Question:

Retention Period: How does your solution manage tiered storage for different retention needs, and what are the cost implications for each tier?

This information is proprietary to the current vendor and is therefore not available.

47 Document Name:

Attachment A-Statement of Work.pdf Section: 2.4 Page: 31-34 Question:

Indexed vs. Raw Storage: What is the expected storage footprint for indexed data versus raw log data?

This is dependent upon the proposed solution and configuration of the winning bid.

48 Document Name: Attachment A-Statement of Work.pdfSection: 2.4 Page: 31-34Question: Indexed vs.

Raw Storage: What is the impact of different indexing strategies on storage requirements and search performance?

This will be dependent upon the agreed upon solution and configuration of the awarded CSP.

49 Document Name:

Attachment A-Statement of Work.pdf Section: 2.4 Page: 31-34 Question:

Searchable History: How many days/months of data will be immediately searchable for real-time analysis and incident response?

Respondents may propose a solution based on industry best practice. All proposals should meet the requirements stated in Section 2.4, Wide Area Network Enterprise Security Services, of Attachment A- Statement of Work, v3.

50 Document Name:

Attachment A-Statement of Work.pdf Section: 2.4 Page: 31-34 Question:

Searchable History: What is the typical query performance over large volumes of historical data?

This information is not available as it is outside of the scope of this ITN.

51 Document Name:

Attachment A-Statement of Work.pdf Section: 2.4 Page: 31-34 Question:

Number of Correlation Rules/Use Cases: How many out-of-the-box correlation rules or security use cases does the SIEM provide?

Respondents may propose a solution based on industry best practice. All proposals should meet the requirements stated in Section 2.4, Wide Area Network Enterprise Security Services, of Attachment A- Statement of Work, v3.

52 Document Name:

Attachment A-Statement of Work.pdf Section: 2.4 Page: 31-34 Question:

Number of Correlation Rules/Use Cases: What is the process and typical time required to develop custom correlation rules based on our specific environment?

This will be dependent upon the agreed upon solution and configuration of the awarded CSP.

53 Document Name: Attachment A-Statement of Work.pdfSection: 2.4 Page: 31-34Question: Threat Intelligence Feeds: How many concurrent threat intelligence feeds can the SIEM ingest and process?

This will be dependent upon the agreed upon solution and configuration of the awarded CSP.

54 Document Name:

Attachment A-Statement of Work.pdf Section: 2.4 Page: 31-34 Question:

Number of Analysts: How many incumbent contractor security analysts are concurrently using the SIEM for monitoring, investigation, and reporting?

This will be dependent upon the agreed upon solution and configuration of the awarded CSP.

55 Document Name:

Attachment A-Statement of Work.pdf Section: 2.4 Page: 31-34 Question:

Anticipated Growth Rate: What is the projected annual growth rate for log volume and number of log sources over the next 3- 5 years? (e.g., 10-20% year over year)

This will be dependent upon the agreed upon solution and configuration of the awarded CSP.

56 Document Name:

Attachment A-Statement of Work.pdf Section: 2.4 Page: 31-34 Question:

Anticipated Growth Rate: How does the solution scale to accommodate this growth without requiring significant re-architecture or downtime?

This will vary based on the Respondent's proposed solution and configurations.

57 Document Name:

Attachment A-Statement of Work.pdf Section: 2.4 Page: 31-34 Question:

Headroom for Spikes: What percentage of headroom do you recommend for unexpected spikes in activity or during active security incidents?

This will be dependent upon the agreed upon solution and configuration of the awarded CSP.

58 Document Name: Attachment A-Statement of Work.pdfSection: 2.14 Page: 123-125Question: What current Zero Trust Network Access (ZTNA) components have been deployed in MFN-2?

The requested information is not available. This information is related to Secure Access Service Edge (SASE), which is not offered under the current MyFloridaNet-2 (MFN-2) contract.

59 Document Name:

Attachment A-Statement of Work.pdf Section: 2.14 Page: 123-125 Question:

Number of Users: How many total users will access applications and data through the Security Service Edge (SSE) platform? (Distinguish between employees, contractors, partners, etc.)

The requested information is not available. This information is related to Secure Access Service Edge (SASE), which is not offered under the current MyFloridaNet-2 (MFN-2) contract.

60 Document Name:

Attachment A-Statement of Work.pdf Section: 2.14 Page: 123-125 Question:

Number of Users: How many concurrent users do you anticipate during peak times?

The requested information is not available. This information is related to Secure Access Service Edge (SASE), which is not offered under the current MyFloridaNet-2 (MFN-2) contract.

61 Document Name:

Attachment A-Statement of Work.pdf Section: 2.14 Page: 123-125 Question:

Number of Devices: How many corporate-managed devices (laptops, mobile phones) will be secured by the SSE?

The requested information is not available. This information is related to Secure Access Service Edge (SASE), which is not offered under the current MyFloridaNet-2 (MFN-2) contract.

62 Document Name:

Attachment A-Statement of Work.pdf Section: 2.14 Page: 123-125 Question:

Number of Devices: How many unmanaged devices (BYOD) will require secure access?

The requested information is not available. This information is related to Secure Access Service Edge (SASE), which is not offered under the current MyFloridaNet-2 (MFN-2) contract.

63 Document Name: Attachment A-Statement of Work.pdf Section: 2.14 Page: 123-125 Question: Number of Branch Offices/Locations: How many physical office locations will connect to the SSE?

The requested information is not available. This information is related to Secure Access Service Edge (SASE), which is not offered under the current MyFloridaNet-2 (MFN-2) contract.

64 Document Name:

Attachment A-Statement of Work.pdf Section: 2.14 Page: 123-125 Question:

Number of Branch Offices/Locations: What is the number of users at each location?

The requested information is not available. This information is related to Secure Access Service Edge (SASE), which is not offered under the current MyFloridaNet-2 (MFN-2) contract.

65 Document Name:

Attachment A-Statement of Work.pdf Section: 2.14 Page: 123-125 Question:

Number of Applications: How many internal (on-premises and cloud-hosted) applications will users access via ZTNA (Zero Trust Network Access)?

The requested information is not available. This information is related to Secure Access Service Edge (SASE), which is not offered under the current

66 Document Name:

Attachment A-Statement of Work.pdf Section: 2.14 Page: 123-125 Question:

Number of Applications: How many SaaS applications will be controlled/monitored by the SWG (Secure Web Gateway) and CASB (Cloud Access Security Broker) components?

The requested information is not available. This information is related to Secure Access Service Edge (SASE), which is not offered under the current MyFloridaNet-2 (MFN-2) contract.

67 Document Name:

Attachment A-Statement of Work.pdf Section: 2.14 Page: 123-125 Question:

Application Traffic Volume: What is the estimated bandwidth usage (upload/download) for traffic f lowing through the SSE (e.g., per user, per location, total)?

The requested information is not available. This information is related to Secure Access Service Edge (SASE), which is not offered under the current MyFloridaNet-2 (MFN-2) contract.

68 Document Name: Attachment A-Statement of Work.pdf Section: 2.14 Page: 123-125 Question: Application Traffic Volume: What percentage of this traffic is web, SaaS, or private application access?

The requested information is not available. This information is related to Secure Access Service Edge (SASE), which is not offered under the current MyFloridaNet-2 (MFN-2) contract.

69 Document Name:

Attachment A-Statement of Work.pdf Section: 2.14 Page: 123-125 Question:

Application Traffic Volume: What is the estimated volume of data uploaded/downloaded to/from cloud storage and SaaS applications?

The requested information is not available. This information is related to Secure Access Service Edge (SASE), which is not offered under the current MyFloridaNet-2 (MFN-2) contract.

70 Document Name:

Attachment A-Statement of Work.pdf Section: 2.14 Page: 123-125 Question:

Critical Application Usage: For business-critical applications, what are the expected latency and throughput requirements?

Please refer to Section 2.14, SASE Secure Access Service Edge, of Attachment A-Statement of Work v3. The Respondent is expected to provide this information in its proposed solution description.

71 Document Name:

Attachment A-Statement of Work.pdf Section: 2.14 Page: 123-125 Question:

Data at Rest/in Motion for DLP: What is the estimated volume of sensitive data (in GB/TB) that will be subject to DLP scanning in cloud applications (at rest)?

The requested information is not available. This information is related to Secure Access Service Edge (SASE), which is not offered under the current MyFloridaNet-2 (MFN-2) contract.

72 Document Name:

Attachment A-Statement of Work.pdf Section: 2.14 Page: 123-125 Question:

Data at Rest/in Motion for DLP: What is the estimated daily volume of sensitive data (in GB) that will be processed by DLP for data in motion (web traffic, email, SaaS uploads)?

The requested information is not available. This information is related to Secure Access Service Edge (SASE), which is not offered under the current MyFloridaNet-2 (MFN-2) contract.

73 Document Name: Attachment A-Statement of Work.pdfSection: 2.14 Page: 123-125Question: Internet Bandwidth: What is the total aggregate internet bandwidth that will be routed through the SSE?

The requested information is not available. This information is related to Secure Access Service Edge (SASE), which is not offered under the current MyFloridaNet-2 (MFN-2) contract.

74 Document Name:

Attachment A-Statement of Work.pdf Section: 2.14 Page: 123-125 Question:

Internet Bandwidth: What are the bandwidth capacities of the primary internet connections at each office location?

Please refer to Tab 11, Site Inventory, of Attachment K- Cost Reply Price Workbook v3.

75 Document Name:

Attachment A-Statement of Work.pdf Section: 2.14 Page: 123-125 Question:

SD-WAN Integration: How many SD-WAN enabled locations or devices will integrate with the SSE?

The requested information is not available. This information is related to Secure Access Service Edge (SASE), which is not offered under the current

76 Document Name:

Attachment A-Statement of Work.pdf Section: 2.14 Page: 123-125 Question:

SD-WAN Integration: What is the total bandwidth aggregated across all SD-WAN tunnels?

Zero. Currently, there are no customers utilizing SD-WAN on MFN-2.

77 Document Name:

Attachment A-Statement of Work.pdf Section: 2.14 Page: 123-125 Question:

PoP (Point of Presence) Connectivity: How many users/locations will connect to each of the vendor's SSE PoPs?

The requested information is not available. This information is related to Secure Access Service Edge (SASE), which is not offered under the current MyFloridaNet-2 (MFN-2) contract.

78 Document Name: Attachment A-Statement of Work.pdfSection: 2.14 Page: 123-125Question: PoP (Point of Presence) Connectivity: What are the expected latency figures from our key locations to your nearest PoPs?

Customers' key locations and the nearest Respondent points of presence are unknown to the Department;

therefore, this information is not available.

79 Document Name:

Attachment A-Statement of Work.pdf Section: 2.14 Page: 123-125 Question:

Number of Security Policies: How many individual security policies (e.g., web filtering, access control, DLP rules) are typically configured for an organization of our size and complexity?

The Department does not have this information, as it is decided by the Customers.

80 Document Name:

Attachment A-Statement of Work.pdf Section: 2.14 Page: 123-125 Question:

Number of Security Policies: How does the number of policies impact performance?

Section 2.14, SASE Secure Access Service Edge, of Attachment A-Statement of Work, v3 requests that respondents propose a SASE to be offered as an optional service. The Department anticipates that the number of security policies may vary based on the recommended solution.

81 Document Name:

Attachment A-Statement of Work.pdf Section: 2.14 Page: 123-125 Question:

Encrypted Traffic Inspection: What percentage of MFN-2 traffic is typically encrypted (SSL/TLS)?

The requested information is not available. This information is related to Secure Access Service Edge (SASE), which is not offered under the current MyFloridaNet-2 (MFN-2) contract.

82 Document Name:

Attachment A-Statement of Work.pdf Section: 2.14 Page: 123-125 Question:

Encrypted Traffic Inspection: What is the performance impact of decrypting and inspecting this volume of encrypted traffic?

The requested information is not available. This information is related to Secure Access Service Edge (SASE), which is not offered under the current MyFloridaNet-2 (MFN-2) contract.

83 Document Name: Attachment A-Statement of Work.pdfSection: 2.14 Page: 123-125Question: Number of Daily/Weekly/Monthly Alerts: What is the expected volume of security alerts generated by the SSE per day/week/month?

The requested information is not available. This information is related to Secure Access Service Edge (SASE), which is not offered under the current MyFloridaNet-2 (MFN-2) contract.

84 Document Name:

Attachment A-Statement of Work.pdf Section: 2.14 Page: 123-125 Question:

Growth Projections: What is the projected annual growth rate for users, devices, applications, and network traffic over the next 3-5 years?

The requested information is not available. This information is related to Secure Access Service Edge (SASE), which is not offered under the current MyFloridaNet-2 (MFN-2) contract.

85 Document Name:

Attachment A-Statement of Work.pdf Section: 1.1 Page: (table 1) Question:

The State lists TSP management in the activities for the CSP in Table 1, can the state detail what that management includes?

Please refer to Section 2.3.6, Core Services Provider, and Section 2.12, General Specifications, Types of Services and Associated Component, of Attachment A-Statement of Work v3.

86 Document Name:

Attachment A-Statement of Work.pdf Section: 2.3.9 Page: 27 Question:

Could the State clearly define which of the capabilities of OwnCloud they use and would expect in a new Collaboration system?

Document repository and sharing. Please refer to Section 2.3.9, Support for Team Collaboration Tool, of Attachment A-Statement of Work v3.

87 Document Name:

Attachment A-Statement of Work.pdf Section: 2.7.19 Page: 73-74 Question:

Will the State clarify that this is one business day or one calendar day?

Please refer to Section 2.7.19, Physical Security as a component of High Availability and High Reliability, of Attachment A- Statement of Work v3. The Department's personnel will be allowed access to these facilities at any time with at least one business day's advance notice.

88 Document Name: Attachment A-Statement of Work.pdf Section: 2.8.5 Page: 78 Question: Will the State act as an arbiter in situations with outages at the TSP level impacting the CSP?

The CSP will not be responsible for SLAs determined to be the responsibility of the TSP.

Section 3.1 Performance Measures of Attachment A- Statement of Work details the process. Per Section 3.1.1.m.5.Transport Services Provider SLA violations preventing Core Services Provider from performing work is an approved SLA hold.

89 Document Name:

Attachment A-Statement of Work.pdf Section: 2.9.8 Page: 98 Question:

Please provide the version number, modules, hosting locations, network bandwidth utilization, hardware currency, software currency, and compression ratios for the different log types for the incumbent Security Information and Event Management (SIEM) platform.

The SIEM manufacturer is Arcsight (version 24.3) located in Melbourne, Florida (primary location) and Smyrna, Georgia (backup location).

The rest of the information is not available as the current SIEM platform is owned and managed by the current contractor.

90 Document Name:

Attachment A-Statement of Work.pdf Section: 2.4.4 Page: 36 Question:

Please provide the average daily log ingest for the Security Information and Event Management (SIEM) platform for the period of June 1, 2024 to May 31, 2025 in gigabyte (GB) per day and/or Events Per Second (EPS).

This information is not available as the current SIEM platform is owned and managed by the current contractor.

91 Document Name: Attachment A-Statement of Work.pdfSection: 2.4.4 Page: 36Question: If the Security Information and Event Management (SIEM) platform is integrated with a User and Entity Behavior Analytics (UEBA) platform, please provide the total quantity of users and/or entities being monitored by the UEBA platform.

The MFN-2 Security Information and Event Management (SIEM) platform is not integrated with a User and Entity Behavior Analytics (UEBA) platform. Therefore, this information is not available.

92 Document Name:

Attachment A-Statement of Work.pdf Section: 2.4.4 Page: 36 Question:

Please provide the total quantity of Security Orchestration, Automation, and Response (SOAR) playbooks currently used by the Security Operations Center (SOC) personnel. Please provide the name of the Original Equipment Manufacturer (OEM) of the SOAR platform.

This information is not available as the current SIEM platform is owned and managed by the current contractor.

93 Document Name:

Attachment A-Statement of Work.pdf Section: 2.1.4.7 Page: 18 Question:

Please provide the monthly average of security incidents (i.e., tickets) resolved by the Security Operations Center (SOC) personnel for the period of June 1, 2024 to May 31, 2025.

The monthly average of security incidents resolved by SOC personnel from June 1, 2024 to May 31, 2025, is 89.

94 Document Name:

Attachment A-Statement of Work.pdf Section: 2.4.2 Page: 34 Question:

Please provide the total quantity of security incidents (i.e., tickets) resolved by the Incident Response (IR) personnel that perform IR services for security incidents that were not resolved by the Security Operations Center (SOC) personnel for the period of June 1, 2024 to May 31, 2025.

This information is not available as the current process is owned and managed by the current contractor.

95 Document Name: Attachment A-Statement of Work.pdfSection: 2.4.2 Page: 34Question: Please provide the total quantity of security incidents (i.e., tickets) resolved by the Incumbent Contractor that were categorized as litigation holds for the period of June 1, 2024 to May 31, 2025.

This information is not available.

96 Document Name:

Attachment A-Statement of Work.pdf Section: 2.14 Page: 124 Question:

Is there an Identity & Access Management (IAM) solution that will need to be migrated to MFN-3?

No, there is no IAM solution that will need to be migrated to MFN-3. IAM is related to SASE, which is not offered under MFN-2.”

97 Document Name:

Attachment A-Statement of Work.pdf Section: General Page: General Question:

What are the defined roles and areas of responsibility between the incumbent SOC provider and MFN-2 customers from an operational perspective?

SOC is operationally responsible for the services subscribed to by the MFN-2 customer and inherent to MFN-2 service. Please see the MFN-2 contract on the Florida Accountability Contract Tracking System (FACTS) for additional details:

https://facts.fldfs.com/Search /ContractSearch.aspx

98 Document Name: Attachment A-Statement of Work.pdf Section: 2.3.3 Page: 23 Question: Will DMS provide the Lab environment and network connections for service testing before production deployment or will the CSP be required to provide and maintain the lab environment including network connections for the term of the contract?

The CSP is required to provide and maintain the lab environment per Section 1.1, Introduction, of Attachment A-Statement of Work v3.

99 Document Name:

Attachment A-Statement of Work.pdf Section: General Page: General Question:

USPS Physical Address: What are the addresses for the 6 Data Centers currently being utilized by the State of Florida for

MFN-2

This question is related to critical infrastructure and is exempt from disclosure under s. 119.0725(2)(b), F.S.

100 Document Name:

Attachment A-Statement of Work.pdf Section: 2.3.13 Page: 29 Question:

The Core Services Provider shall not be permitted to charge for surcharges, fees, or taxes included but not limited to Universal Service Fund Fees. Is the State equipped with exemption forms to be provided for the all surcharges, fees and taxes?

The Core Services Provider shall not be permitted to charge for surcharges, fees, or taxes included but not limited to Universal Service Fund Fees, Attachment A Statement of Work, Section 2.3.13

101 Document Name: Attachment A-Statement of Work Section: 2.3.18 Page: 31 Question: Vendor Access to Sites-Any physical site that is used to provide service to MFN-3 customers shall use access procedures that require visitors to provide their U.S. or State Government-issued identif ication for verif ication by security.

Access to sites by any vendor, subcontractor, or other visitors is to be digitally logged. Will the State accept Contractor's employee badges as identif ication?

No, per Section 2.3.18 of Attachment A, Statement of Work, v3, Any physical site that is used to provide service to MFN-3 customers shall use access procedures that require visitors to provide their U.S. or State Government-issued identif ication for verif ication by security. Suitable Identif ication would be a driver's license or other Government issued photo

ID.

102 Document Name:

Attachment A-Statement of Work Section: 2.1.2 Page: 12 Question:

Staffing - Local Service Availability - Regarding the Tallahassee on-site requirement: Is this for a 40-hour work week or "when requested?" For which role(s) in the provided Staffing Plan are you requesting?

Please refer to Section 2.1.2, Staffing - Local Service Availability, of Attachment A- Statement of Work v3. The Department's primary objective is for the CSP to be able to provide timely response to service needs.

Respondents should propose a solution, including key roles, they feel will best meet the needs of the Department based on available resources and proposed solutions to other sections.

103 Document Name:

Attachment A-statement of Work Section: 2.7.6 Page: 67 Question:

Contractor is curious about the certif ication of monitoring not impacting the State's network performance. We manage a global network and have customers with high performance networking solutions. None of these customers have such a large monitoring requirement. Based on our experience, the more load placed on the network by monitoring decreases the flexibility the network has to respond to end user requirements.

Would the state consider dropping the certif ication or reducing the monitoring requirements?

Per Section 2.7.6. a.

Attachment A-statement of Work, v3, respondents should provide a proposal for how MFN-3 will support SLA measurement. SLA measurement is required, so respondents should account for related service impacts when sizing the MFN-3 Core Network hardware.

104 Document Name: Attachment A-Statement of work Section: 2.7.1.a Page: 63 Question: Can the State define uptime in relationship to weather and uncontrolled events?

The same uptime in Section 2.7.1.a of Attachment A- Statement of Work v3, shall apply. However, any uptime calculations or SLAs impacted due to Force Majeure may be exempt per Section 5.n. Force Majeure, Notice of Delay, and No Damages for Delay, Exhibit 3 - PUR 1000 upon Department approval.

105 Document Name:

Attachment A-Statement of work Section: 2.12.2 Page: 70 Question:

The State is asking for a uniform configuration management and monitoring framework between the CSP and TSP networks. Contractually this would need to be implemented by DMS. As industry best practice, Contractor recommends that DMS establish a standard model for configuration management, monitoring etc. and build that into each of the contracts they issue. Will the State consider this approach?

No. Per Section 2.12.2 End- To-End Integration of Attachment A - Statement of Work, v3, respondents should define where any local loop access services characteristics will not appear seamless end-to-end in their response.

106 Document Name: Attachment A-Statement of work Section: 2.4.3 Page: 36 Question: Please provide the maximum quantity of concurrent devices the incumbent Network Access Control (NAC) solution is capable of handling based on the Original Equipment Manufacturer's (OEM) guidelines and technical specifications for optimal performance. For the purpose of this question, the definition of a device is any asset with a Media Access Control (MAC) address that connects to the MFN-2 network over a wired or wireless connection that requires authorization to connect to the MFN-2 network by the NAC solution. An example of a device includes, but is not limited to, servers, desktops, laptops, mobile phones, tablets, Internet Protocol (IP) telephones, switches, routers, Internet of Things (IoT), Operational Technology (OT), etc.

This question pertains to configurations that identify detection and response practices related to cybersecurity incidents and is exempt from disclosure under s. 119.0725(2)(d).

107 Document Name:

Attachment A-Statement of work Section: 2.4.3 Page: 36 Question:

Please provide the maximum quantity of concurrent sessions the incumbent MFN-2 Network Access Control (NAC) solution is capable of handling based on the Original Equipment Manufacturer's (OEM) guidelines and technical specifications for optimal performance.

This question pertains to configurations that identify detection and response practices related to cybersecurity incidents and is exempt from disclosure under s. 119.0725(2)(d).

108 Document Name:

Attachment A-Statement of work Section: 2.4.3 Page: 36 Question:

Please provide the total quantity of tickets categorized as a Service Request, Problem, and Incident from the Information Technology Service Management (ITSM) system that were resolved by the incumbent Contractor for Network Access Control (NAC) for the Period of Performance (PoP) of June 1, 2024 to May 31, 2025.

The requested information is not available as the Department does not track this metric.

109 Document Name: Attachment A-Statement of work Section: 2.4.3 Page: 36 Question: If the incumbent MFN-3 Network Access Control (NAC) solution's maximum demand threshold exceeds the Original Equipment Manufacturer (OEM) equipment capacity by a factor greater than (>) ten percent (10%) for a period greater than or equal to (>=) thirty (30) seconds, will the end users and/or devices that were connected to the network disconnect from the network and require automated and/or manual reauthentication?

This question pertains to configurations that identify detection and response practices related to cybersecurity incidents and is exempt from disclosure under s. 119.0725(2)(d).

110 Document Name:

Attachment A-Statement of work Section: 2.4.3 Page: 36 Question:

For the incumbent MFN-2 Network Access Control (NAC) solution, please provide the total quantity of devices that are not contractor-owned and contractor-managed that require authorization to connect to the MFN-2 network by the NAC solution.

This number is fluid, but it is approximately 1430.

111 Document Name: Attachment A-Statement of work Section: 2.4.3 Page: 36 Question: If the incumbent MFN-2's Network Access Control (NAC) preconditions that govern the authorization of user's and/or device's network access are not met, what automated and/or manual remediation actions are employed to enable access to the network resources? For example, if a user attempts to access a network resource with an approved device that does not meet the precondition that requires the device's operating system to have current patches, will the device be logically connected to a remediation Virtual Local Area Network (VLAN) that will automatically connect to the patching server to update the device, or will the user be required to manually initiate the patching from a…