Response to Offeror Questions document.docx

Request for Information (RFI) Questions and Responses

1. Will there be a separate RFP released later for this engagement?

· We are looking for baseline pricing models as part of the RFI process. It is still unknown if a follow-up RFP will be released.

2. Can you provide the device/user counts for various universities?

3. What is the number of SaaS email users (O365, Google, etc.)?

· Estimated around 92,000 total accounts (46,000 students/faculty and 46,000 alumni) based on MFA licensing numbers.

4. What data sources are you expecting to monitor besides the standard system integration sources listed?

· Data sources may vary by university needs; standard solutions required for monitoring are listed in the RFI.

5. Are there any custom applications or services that generate logs you need to monitor?

· Ellucian Banner and Oracle are the primary solutions used centrally.

6. What are your data retention requirements?

· SIEM retention for 1 year.

7. Are you able to work with any ticketing system or is there a specific system we’d need to integrate with?

· We use TDX for system ticketing but it is not a requirement for MDR.

8. Will all schools be part of the awarding or will they each have the option to participate?

· All 6 universities in the system are expected to utilize the service.

9. Is there an incumbent provider?

· No, this will be a new service.

10. What is the SDBOR’s Sentinel daily ingestion rate?

· Initial estimates between 500GB and 1 TB annually for the entire system.

11. Will SDBOR be utilizing a partner? If so, please provide the channel that you prefer to work with?

· We work with many partners; if you have one in mind, please respond with them.

12. Does the South Dakota Board of Regents have an anticipated timeframe for when they expect to notify respondents on whether they will be invited to conduct a product demonstration or not?

· No defined timeline; it will depend on the number of responses received.

13. Does the South Dakota Board of Regents plan to release a scope of the project that includes more details on pricing and specifications?

· No set details yet; quantities of workstations, servers, and users provided earlier.

14. Can you provide industry-related performance/analysis to compare to other higher education customers?

· Interested in metrics on detection/response times, security maturity, common threats, resource utilization, customer satisfaction, cost-effectiveness, compliance support, and case studies.

15. Is the Defender and Sentinel Environment deployed today?

· Defender has been in use for several years; Sentinel is being rolled out currently.

16. Will SDBOR be selecting a vendor based on the results of this RFI or will an RFP be released to certain vendors based on responses of the RFI?

· Yet to be determined.

17. Regarding incident response, how many hours would you like to see on retainer? 120 or 240?

· Lower number (120 hours) likely appropriate.

18. Are you looking to leverage your existing Microsoft licensing?

· Yes, we leverage existing Microsoft licensing.

19. What is your current M365 licensing?

· Mix of A5 and A3+Security at the universities.

20. Are you licensed for security Copilot?

· Not currently licensed.

21. What is your technical security staff size today?

· Around 18 security professionals across the system.

22. Do you have a CISO who is driving direction on cybersecurity initiatives?

· Yes, each campus and the BOR have a CISO.

23. Do you intend to rollout Defender for Identity in M365 in addition to Defender for Endpoint that you have today?

· Some use today, evaluating options to expand.

24. Are you transitioning away from an existing MDR/XDR solution that would require moving historical logs into Sentinel?

· No, we are not moving historical logs into Sentinel.

25. Do you currently have cyber insurance?

· Yes, we have cyber insurance.

26. What ITSM platform are you currently on?

· Mix of different solutions; no standard across the system.

27. Are there any log sources that aren’t defined in the technical requirements?

· There may be more log sources not identified yet that universities would want to source logs from.

28. What compliance are you adhering to?

· HIPAA, FERPA, GLBA.

29. Do you have any current incident recovery issues needing work or assistance?

· Interested in assisting smaller campus teams with IR needs.

30. Do you have CUI data or a CUI network?

· Yes, we handle Controlled Unclassified Information (CUI).

31. Have you performed a self-assessment for cybersecurity?

· Yes, performing self-assessments and a 3rd party assessment.

32. Do you need to adhere to CMMC2 requirements by October?

· No, we do not need to adhere by October.

33. Is there a set budget or timeline for this solution to be in place?

· No set budget or timeline.

34. Does the MDR provider have to use SDBOR’s existing MS Sentinel instance or can the MDR service provide its own SIEM?

· Yes, we will use Microsoft Sentinel as the primary SIEM.

35. Are you looking to replace Microsoft Sentinel with a new SIEM as well as MDR as part of this response?

· No, we are onboarding Microsoft Sentinel.

36. Is the SDBOR using Lighthouse to manage multiple tenants itself or using a 3rd party to do so?

· Yes, centralized Lighthouse instance to manage all tenants.

37. We saw you ask about AWS integration but it wasn’t listed as a primary log source. Do you have AWS and need integration?

· Some campuses may use AWS, but it is limited.

38. Are student accounts in the same Azure/365 tenants as faculty/staff or separate?

· Each campus has its own tenant environment with both students and faculty/staff.

39. How long do you require logs to be stored?

· Planned for a year of SIEM logs within Sentinel.

40. Do we need to be on the South Dakota State contract to be considered?

· No requirement to have a state contract.

41. Is it a requirement for the chosen MDR provider to support Microsoft Defender for Cloud?

· Not a requirement; utilization of cloud applications is minimal.

42. What is the timeline for SDBOR to implement an MDR solution and are you currently leveraging a SOC/SIEM that’s not hitting the mark? Has a budget been allocated to move to an MDR solution and can you share how much that is?

· No set budget; decision likely within the next year.

43. Will end user contract with just one vendor or more?

· Yes, end-user will contract with one vendor.

44. Was this RFI created internally or was a 3rd party resource used to help create the RFI? If so, will that 3rd party be allowed to participate in bidding on the RFI?

· Created internally; no third-party participation in the RFI.

45. Please confirm that current RFI Scope is for Manage Detect and Respond (MDR) services at a 24x7x365 pace.

· Confirmed 24x7x365 service.

46. What is the current Log Collection & Storage requirements? Is 7 days hot/90 days warm/365 days cold (some level of collection/storage will be required to support Analysis & Response).

· Using Microsoft Sentinel; current retention rate will continue.

47. Are there specific compliance reporting requirements?

· Full compliance and security review before selection; no specific requirements yet.

48. What is the current storage solution being utilized?

· Storage varies.

49. What is the current backup solution being utilized?

· Immutable backup solution with Exagrid and Veeam being rolled out.

50. What phone system is being utilized?

· Primarily Cisco.

51. Do you have SOAR solutions you would like implemented as part of the solution?

· Interested in reviewing capabilities to provide SOAR solutions.

52. Do you know your current EPS – Events Per Second for in-scope networks?

· Varies by each university; can be reviewed further if required for quotes.

53. What email security solutions are you currently using?

· KnowBe4, Defender for O365

54. What endpoint protection solutions are you currently using?

· Defender for Endpoint

55. What identity provider solutions are you currently using?

· Active Directory, Azure AD, Defender for Identity

56. What threat intelligence solutions are you currently using?

· N/A

57. What active protect delivery services are you currently using?

· N/A

58. Are you using a Cloud Access Security Broker (CASB)? If so, which one?

· MS Defender for Cloud Apps

59. What cloud protection solutions are you currently using?

· Mostly on Azure, but the system does not widely use cloud environments. SaaS solutions managed by vendors are more prevalent.

60. What compliance solutions are you currently using?

· We are using some features of Purview, but not all universities have the licensing today.

61. What firewall solutions are you currently using?

· Standard across the system is Cisco 3100 series with some Meraki usage for remote sites.

62. What IoT solutions are you currently using?

· Not sure what is used at the campuses, but nothing is utilized within the BOR office itself.

63. What IPS/IDS solutions are you currently using?

· Cisco

64. What security log analysis solutions are you currently using?

· Linux and Windows Security Log feed analysis

65. What VPN appliance solutions are you currently using?

· Cisco

66. What vulnerability management solutions are you currently using?

· Nessus, Qualys, Tenable (all three are in use at some level).

67. What web filtering solutions are you currently using?

· Cisco Umbrella

68. What is the quantity and usage of cloud services (3rd party SaaS, etc.)?

· 92 system-wide cloud services. More at universities.

69. Can you provide the quantity of domain controllers, Windows/Linux member servers, web servers, hypervisors, IoT devices, and network equipment (non-firewall)?

· Quantities would need to be requested from the universities.