Request for Information_CISA EDR RFI FINAL_10_13_2021.pdf

Request for Information (RFI) – Endpoint Detection and Response (EDR)

Agency: Cybersecurity and Infrastructure Security Agency (CISA)

Market Research Agency: General Services Administration (GSA), Federal Acquisition Service (FAS), Region 8

Notice Type: Request for Information (RFI)

NAICS: 541519- Other Computer Related Services

GSA Reference: 47QFRA22K0001 Posted Date: October 14, 2021

GENERAL INFORMATION:

The General Services Administration (GSA), Federal Acquisition Service (FAS), Region 8 is issuing this Request for Information (RFI) on behalf of the Cybersecurity and Infrastructure Security Agency (CISA).

RFI OBJECTIVE:

The purpose of this RFI is to assist the Government in conducting market research focused on gaining technical feedback from industry on tools and services that would provide sophisticated endpoint detection and response (EDR) capabilities for U.S.- based government organizations. This information will be used for market research only. The Government is not obligated to release a future solicitation based on this market research.

BACKGROUND:

On May 12, 2021, the President of the United States signed Executive Order (EO) 14208, “Improving the Nation’s Cybersecurity” to support our nation’s cybersecurity and protect the critical infrastructure and Federal Government networks underlying the nation’s economy and way of life.1 CISA will play a large role in several aspects of the EO including early detection of cybersecurity incidents on Federal Government networks and improving investigative and remediation capabilities. Under the improve detection pillar of the EO, CISA will work with agencies to provide additional insight for the Continuous Diagnostic and Mitigation (CDM) program, continue the implementation of the persistent cyber hunt, detection, and response capability that was authorized in the most recent National Defense Authorization Act; and work with OMB to ensure that new EDR efforts are adequately resourced and implemented across agencies. Additionally, building on the need for increased visibility into the movements in and out of federal networks, CISA will also work with OMB to design and facilitate the implementation of EDR tools, funded in part by the American Rescue Plan Act (ARPA).The ARPA provided $650M to CISA, which will be used to improve CISAs response capabilities, upgrade its ability to support security projects at agencies and departments, and deploy modern endpoint protections for the federal civilian networks.2

CISA is executing an approach where major investments in validated EDR tools can be expanded at agencies. In this model, CISA would, in full collaboration with Agencies and their security operations staff, identify and validate specific EDR tools that are functionally capable and compatible with CISA’s mission to unify the Federal Civilian Executive Branch (FCEB) enterprise in enabling coordinated threat detection

1 Executive Order on Improving the Nation's Cybersecurity | The White House 2 FACT SHEET: President Signs Executive Order Charting New Course to Improve the Nation’s Cybersecurity and Protect Federal Government Networks | The White House https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/ https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/ https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/ https://www.whitehouse.gov/briefing-room/statements-releases/2021/05/12/fact-sheet-president-signs-executive-order-charting-new-course-to-improve-the-nations-cybersecurity-and-protect-federal-government-networks/ https://www.whitehouse.gov/briefing-room/statements-releases/2021/05/12/fact-sheet-president-signs-executive-order-charting-new-course-to-improve-the-nations-cybersecurity-and-protect-federal-government-networks/ and response. This approach is inclusive of evaluating the existing investments Agencies have made in their EDR tooling (and security processes), and soliciting from agencies true technology needs (i.e., gaps in functionality and/or coverage).

In executing this approach, CISA is taking a risk-based approach to advance existing EDR capabilities and investments by providing additional tools to fill identified gaps at each agency’s EDR. This process involves addressing gaps in both coverage of the EDR tools across the agency’s endpoints as well as in functionality for tools that may not be fully configured to leverage functions and features of the product in alignment with CISA’s requirements. As part of this approach, CISA has defined a common set of EDR requirements to ensure that agencies gain the necessary visibility and response functionality needed to effectively detect and respond to cyber intrusions. This strategy ensures that CISA invests in market-leading EDR tooling, founded on standards-based validation processes, that are proven effective against known and novel Tactics, Techniques, and Procedures (TTPs).

PURPOSE:

CISA intends to galvanize agency security operations center (SOC) operations by getting as close to 100% coverage as possible on Agency selected and CISA validated, EDR platforms through a “gap-fill” strategy.

A key objective of this EDR RFI is to solicit expertise from industry to validate and/or inform the Government on best practices in process or functionality that should be considered within the context of EDR activities being currently executed (outlined above).

Another key objective of this RFI is to inform a longer-term strategy as to how EDR tools should be maintained across Federal networks over a longer-term horizon based on industry input regarding future capabilities under development, evolution of the market based on customer requirements, and novel strategies being employed by advanced threat actors.

Finally, the information provided by industry may be used by CISA to continuously modernize baseline requirements for CISA’s EDR capability to ensure that a Government baseline for EDR platforms is set at a level that is consummate to the evolving advanced threats that target Federal networks, and tailored against unique requirements of the Federal Civilian Enterprise (e.g. staffing and resource constraints, supply chain considerations, open-standards and interoperability, etc.).

REQUIREMENT OBJECTIVES:

CISA’s CDM program defines the EDR capability as providing cybersecurity monitoring and control of endpoint devices for Federal Agencies. EDR spans the full cybersecurity lifecycle, from the detection of events (observable occurrences in a network or system) and incidents (events that have been determined to have an impact on the organization, prompting the need for response and recovery) on endpoint devices (i.e., workstations, servers, laptops, thin clients, and virtual desktops) and users, to attack responses and incident follow-up and analysis. EDR will also enforce Federal Agency’s EDR administrator access policy based on user attributes and provide for delegation of administrative tasks.

The following are high level (key) functions expected of solutions validated against the requirements of the CDM EDR capability. The below descriptions are high-level functional descriptions of the CDM EDR capability, and additional detail (and decomposed requirements) can be referenced in the most recent CDM Technical Requirements Volume Two posted on GSA’s website3.

3 https://www.gsa.gov/cdnstatic/Integrated_Technology_Services/CDM-PROG-2021- CDM%20Technical%20Volume%202_v24.pdf https://www.gsa.gov/cdnstatic/Integrated_Technology_Services/CDM-PROG-2021-CDM%20Technical%20Volume%202_v24.pdf https://www.gsa.gov/cdnstatic/Integrated_Technology_Services/CDM-PROG-2021-CDM%20Technical%20Volume%202_v24.pdf

1. Configure EDR Security Policy enables authorized users to implement and update agency EDR policy, including, for example, enterprise-wide alert and detection rules, automatic endpoint response actions, and endpoint agent scanning details. Custom plug-ins and scripts may also be configured and deployed to specific endpoints or groups of endpoints. The policy includes the desired state information to support the PDP and PEP.

2. Collect and Manage Cybersecurity-Relevant Endpoint Events collects, organizes, and records cybersecurity-relevant endpoint event information and data artifacts (see requirements for a list of information collected).

3. Maintain Endpoint Visibility provides alerts on events and incidents and an authorized user on-demand query and display of live information about each endpoint (see requirements for a list of information collected).

4. Support Incident Analysis correlates collected cybersecurity-relevant events, forensic artifacts that have been identified through real-time monitoring and analysis, and threat intelligence. EDR provides detailed historic visualizations to support analysts in identifying and managing cyber incidents. This function will also automatically identify incidents.

5. Threat Hunting enables authorized users to discover current Indicator of Compromise (IoCs) and Indicator of Attack (IoAs) related to known or suspected threats and to detect and monitor potential adversary patterns of activity and behaviors. EDR can leverage the community-supported specifications that report threat indicators and integrate with vendor-supported threat intelligence services to provide automated information sharing for cybersecurity situational awareness. Some examples are Structured Threat Information eXpression (STIX™) and Trusted Automated eXchange of Indicator Information (TAXII™). Cyber Observable eXpression (CybOX™) has been incorporated into STIX 2.0. US-CERT Malware analysis reports.

6. Maintain and Report EDR Data provides for authorized user generation of reports and provision of EDR data to the agency. The Federal Incident Notification Guidelines and/or the Federal Incident Response Requirements (FIRR) provide guidance on the data content.

7. Respond to Incidents provides or facilitates (through another platform) automated responses based on EDR information. In some cases, EDR would provide information to an orchestration function (i.e., SOAR platform) external to EDR that would coordinate follow-on responses. EDR can perform a standard set of remediation actions (e.g., isolate the endpoint, kill processes, quarantine files, etc.).

Integrating with a Security, Orchestration, Automation and Response (SOAR) platform can provide for a more robust and timely set of remediation actions that account for legal, policy, and technical considerations.

8. Maintain Access Control will control, delegate, and enforce EDR administrator access policies based on the user’s role and Agency policy.

INDUSTRY MEETINGS:

Based on responses provided by industry, additional information may be requested. As a result, GSA with CISA, at the Government’s discretion, may schedule one-on-one meetings with industry to discuss responses to this RFI. If a follow-up meeting is required, the Government will reach out directly to the industry partner point of contact.

RFI RESPONSE:

The Government is primarily focused on receiving feedback from EDR tool vendors. Responses are required to include the following information:

CONTRACTOR INFORMATION:

□ Contractor Name and Address

□ DUNS Number and NAICS Code

□ Socio-economic status (HUBZone, Service-Disabled-Veteran-Owned, Woman- Owned, 8(a), Small Business, Large Business)

□ Facility clearance level

□ POC Phone and Email

□ Website URL

EXPERIENCE/CORPORATE CAPABILITIES:

1. Provide a narrative summary that addresses the objectives in this RFI and your capability to deliver the solution, including prior achievements. The Government welcomes feedback on the feasibility and utility of the stated objectives above.

2. Does your company have experience building and managing EDR solutions that detect and investigate threats?

3. Identify if your tool is on the CDM Approved Products List (APL). Note: In order for your product to be considered it needs to be on the CDM APL.

INFORMATION REQUESTED:

1. What recommendations does your company have regarding how best to deploy and operationalize EDR solutions across the federal enterprise, including heavily federated agencies, in a way that is operationally efficient and cost-effective, while reducing cyber risk within each agency and government-wide?

2. How should an EDR solution be designed, configured, and deployed to provide an “enterprise deployment” where-by the following objectives are achieved:

a. Sub-organizations can still maintain operational autonomy

b. Exhaustive and complete visibility and control of all known endpoints of a large enterprise

(e.g. Department or Agency) are accessible through a “single pane of glass”, such that there are minimal needs to re-authenticate and/or pivot to alternative consoles to access EDR functionality needed to secure specific endpoints.

3. What minimum critical requirements should an EDR solution include for a federal agency to down-select an EDR tool (e.g., role-based access control, preferred “response” mechanisms, automated analytics as a force multiplier, etc.)?

4. What minimum sets (types) of critical EDR data should be collected by security analysts to identify advanced threats or evidence of an active breach?

a. What is the recommended retention periods per dataset to balance operational effectiveness against costs?

5. What considerations should CISA take into account for future, long-term EDR requirements? For example:

a. API integration support today versus future (e.g., SOAR, SIEM)

b. Support for “cloud native” or “cloud powered” deployments (i.e., FEDRAMP)

c. How to proactively hunt in-memory “at scale” in the enterprise, to detect advanced malware that exists only in memory (e.g. fileless attacks”)

d. EDR evasion techniques and what EDR product/service vendors are doing to compensate

6. Does your EDR solution set provide cloud capabilities for software as a service offering?

7. Does your EDR solution intend on expanding its capabilities to address other types of security telemetry (networking devices, network logs, cloud logs, etc.) to expanding into the XDR/NDR space, if so please detail.

8. Identify any recommended technical performance standards or best current practices that are relevant for EDR?

9. Provide any additional technical information your company believes relevant to this RFI. For example, describe other EDR features and other EDR tools/services your company could offer.

10. Can your company use a non-organic EDR solution or is it required that your company must use your EDR solution as the comprehensive solution? Does it interoperate easily with other tools that complement the EDR capability?

11. How does your EDR solution set address “alert-fatigue” and prioritize detecting the most significant threats that are valid?

12. Does your company recommend EDR as a standalone solution, or to be coupled with other network detection and response activities?

13. How does your company leverage robotic process automation (RPA) and machine learning techniques to continuously improve your EDR solution?

14. What are the cost-basis and model for your EDR offerings (pricing arrangement, includes a hosting/logging requirement/software development (APIs)

CONTRACTOR NOTIFICATION:

This RFI is for information and planning purposes only, and does not constitute a RFQ, and is not to be construed as a commitment by the U. S. Government. No award will be made as a result of this RFI. All information is to be submitted at no cost or obligation to the Government. Any information that the Contractor considers proprietary should be clearly marked as such. All submissions become Government property and will not be returned, including any proprietary information. The Government may consider additional communications with submitting companies utilizing the contact information provided in the Corporate Overview to further the Government’s market research for endpoint detection and response.

• All responses are to use Times New Roman font, with a 12-point font, and one-inch margins, single spaced in all sections in Microsoft Word.

• Contractor Information section shall be no longer than 1 page in length.

• Response to questions should be no longer than 10 pages.

• All information submitted shall be UNCLASSIFIED.

• Any information that the Contractor considers proprietary should be clearly marked as such.

• All submissions become Government property and will not be returned, including any proprietary information.

Questions pertaining to this RFI should be submitted no later than 5:00 PM EST on October 20, 2021, to Diana Zoppi at Diana.zoppi@gsa.gov. All questions and answers will be added to this RFI announcement no later than COB October 27, 2021.

RFI responses shall be submitted no later than 2:00PM ET on November 8, 2021 via email to Diana Zoppi at Diana.zoppi@gsa.gov.

Contractors who do not respond to this RFI are not excluded from any resulting solicitation(s).