Response to Offeror Questions document.pdf

Internet Access Services RFP – 25RFP16406 – Questions and Answers

None of the answers provide new or material information. The schedule nonetheless allows for 28 days from the posting date of these answers for the submission of proposals.

1. In addition to the internet bandwidth being requested, DDoS protection is a service that the majority of our Public Sector customers utilize. At Lumen, we do not offer a one-size-fits-all DDoS solution; instead, we customize it based on the amount of clean traffic required to keep the State of South Dakota up and running on their dedicated circuits.

To do this effectively, it would be helpful to better understand some historical data regarding the state's bandwidth utilization. Are you able to provide historical usage data across individual circuits? For example, if we were to quote six circuits at various speeds, we would want to design a DDoS solution that considers both the total available bandwidth and your historical usage to determine the necessary clean traffic capacity to protect all of the aforementioned circuits.

State Answer: The State expects that the clean traffic capacity would be equal to the total subscribed capacity for any individual circuit.

2. Requirement 1.12 – Internet Circuit Locations outlines a list of service sites and indicates that the State may consider adding or moving services during the contract term. To support accurate planning and resource alignment, could the State clarify whether the sites listed as current service locations are expected to remain active throughout the duration of the contract, or if any changes to their status or infrastructure are currently anticipated?

State Answer: The State is unable to predict the status of each location for the duration of the entire contract.

3. Requirement 1.2.14.1 – DDOS Operation states the “service must also allow manual mitigation by the State.” Is the State requesting the ability to control mitigations?

State Answer: Yes, either by telephone or through a management platform.

4. Section 8, item 8.1 outlines the mandatory and minimum bidding requirements.

However, several references within this section appear to be misaligned with the numbering in Section 3: Scope of Work. As a result, some cited requirements seem to reference sections that do not exist in the current version of the RFP.

For example, requirement 1.11.7 states that “all maintenance notifications described in section 3.9 must be delivered to the State,” yet there is no section 3.9 in the document.

It’s unclear whether this was intended to reference section 1.9 or another part of the

RFP.

Could the State please clarify whether vendors should interpret these misnumbered references as aligning with similarly titled sections in Section 3, or will an updated version of the RFP be issued with corrected section numbers and a revised list of mandatory bidding requirements in Section 8?

State Answer: Please refer to Addendum 1 that resolves the numbering issues in Section 3 of the RFP. All the terms are the same with the exception of correcting the numbering of those subsections.

5. Regarding Section 4.2.6 – Web Application Vulnerability Scan Requirements, could the State please clarify the intended scope of this requirement? Specifically, what types of web-based applications or deliverables are expected to undergo vulnerability scans?

For example, would this include portals used to view support tickets or bandwidth utilization? Additionally, can the State confirm whether the vendor is responsible for performing these scans, or if the State intends to conduct them independently?

State Answer: The web-based applications that would need vulnerability scans include any monitoring portal, DDOS system portal, ticketing portal, or other application handling State data or provided for the State to interact with the Vendor. The State would perform the vulnerability scans in coordination with the Vendor.

6. Question for section 4.2.6 page 33 - Is a web-based deliverable any application that the State accesses only via HTTP or HTTPS from the vendor?

State Answer: Yes.

7. Question for section 4.2.6 page 33 - Can the State provide example web-based deliverables that the vendor would have to provide a vulnerability scan for?

State Answer: The web-based applications that would need vulnerability scans include any monitoring portal, DDOS system portal, ticketing portal, or other application handling State data or provided for the State to interact with the Vendor. The State would perform the vulnerability scans in coordination with the Vendor.

8. Question for section 4.2.6 page 33 - Does the State have a preferred scanning tool they would like the vendor to use when scanning for the OWASP Top Ten?

State Answer: The State would perform the vulnerability scans in coordination with the Vendor.