RFI_12402682_Addendum_No_ 2_signed.pdf

CITY OF ATLANTA

DEPARTMENT OF PROCUREMENT

SUITE 1900

55 TRINITY AVENUE, SW

ATLANTA, GA 30303

(404) 546-1000

Excellence in VALUE CREATION through Partnership, Collaboration, and Innovation

Rev. 8.24.23

Andre Dickens Mayor

Jaideep Majumdar Chief Procurement Officer

M E M O R A N D U M

TO: Potential Proponents / Bidders

FROM: Denise Lewin-Cirilo, Category Lead

CC: Brandi Stanley, Category Manager Jean-Paul Courville, Category Director Tapika Howard, Deputy Chief Procurement Officer

RE: Notice of Addendum Memo for – RFI/IT/DAIM/2403-1240268,2/Managed Security Services Provider (MSSP)

DATE: 4/12/2024

Dear Potential Proponents / Bidders:

Attached is one (1) copy of Addendum Number No. 2 which is hereby made a part of the above referenced project.

ADDENDUM NO. 2

This Addendum No. 2 form is a part of the Request for Information (“RFI”) and modifies the original solicitation package as noted below and is issued to incorporate the following:

1. Responses to: Seventy (70) questions and responses submitted and hereto as Attachment No. 1

2. Bid Due Date has been extended to Monday, April 22, 2024, at 2:00 PM (ET).

DocuSign Envelope ID: DBB877C0-6A3B-47F9-8248-303353F48689

Addendum Memo

Rev. 8.24.23

3. Revision: Section 1.1 of the Instructions to Respondents has been updated to reflect the following:

1.1 This Request for Information (“RFI”) from interested respondents (“Respondent” or “Respondents”) by the City of Atlanta (“City”), on behalf of the Department of Atlanta Information Management ("DAIM") seeks Information Statements from suppliers capable of providing Enterprise Managed Security Services.

**All other pertinent information is to remain unchanged**

All questions and inquiries concerning this project should be directed to Category Lead, Denise Lewin-Cirilo; via e-mail: dlewin-Cirilo@atlantaga.gov.

Attachment(s)

ATTACHMENT NUMBER 1

CITY OF ATLANTA

DEPARTMENT OF PROCUREMENT

SUITE 1900

55 TRINITY AVENUE, SW

ATLANTA, GA 30303

(404) 546-1000

Excellence in VALUE CREATION through Partnership, Collaboration, and Innovation

Rev. 9.25.23

Andre Dickens Mayor

Jaideep Majumdar Chief Procurement Officer

Project Number & Title: RFI/PS/DAIM/2310-1240268,2/Managed Security Services (MSSP) Date: 4/12/2024

Questions and Responses

The following questions and /or clarifications were requested by various proponents:

1. Question

You ask for proposals to manage your firewalls. How many of them are there?

Response Between 10 and 20 Firewalls-we will not provide a specific number

2. Question

What other 'security technologies' (page 6) do you need management of? Are all of these technologies listed in Exhibit D?

Response We expect the MSSP vendor to install-implement their MSSP and bid on operating the Palo Alto Firewalls.

3. Question

Is all of your City traffic presented on a core switch in one location (your primary location at 55 Trinity Avenue)?

Response The City listed the locations of our systems.

4. Question

Do you already run a SIEM? If so, what is it, and approximately how many endpoints are installed currently?

Response We expect the MSSP Vendor to provide the SIEM. The City has over 10,000 employees with endpoint systems.

5. Question

Do you already run a SIEM? If so, what is it, and approximately how many endpoints are installed currently?

Response We expect the MSSP Vendor to provide the SIEM. The City has over 10,000 employees with systems.

6. Question

Please expand on the term 'environmental permit compliance measures' on page 4.?

Response The section 1.1 of the Instructions to Respondents has been updated to the following:

1.1 This Request for Information (“RFI”) from interested respondents (“Respondent” or “Respondents”) by the City of Atlanta (“City”), on behalf of the Department of Atlanta Information Management ("DAIM") seeks Information Statements from suppliers capable of providing Enterprise Managed Security Services.

7. Question

Do you have a dedicated staff that is currently involved with cyber security? If so, approximately how many are there? (less than five or ten, more than five or ten, etc.)

Response Yes, there is a dedicated security team in the city.

8. Question

Paragraph 3.12.8 says that the respondent must offer support for an incident like a natural disaster, riot, and such. Please elaborate on this type of required support.

Response If there is a non-cyber disaster such as a Hurricane, the MSP Vendor, IT and

IT Security will be supporting the City for operating during the event and recovery afterwards.

9. Question

There was a sentence within the: RFI/IT/DAIM/2310-1240268/Managed Security Services Provider (MSSP) that states: "The Service Provider¿s solution must be currently deployed in organizations of a similar size to the city of Atlanta."

Does this mean a company needs to be currently doing business with the city of Atlanta. Or does this mean a company like MindPoint Group must be doing business with a city (any city in the USA) similar size to Atlanta?

Response This means a City, County and or State of our size.

10. Question

In the interest of giving us adequate time to assemble a comprehensive response for this RFI, please accept our request for a 2-week extension to April 29th.

Response The close date has moved to Monday, April 22, 2024.

11. Question

Is this reference to anti-virus alert pop-ups for end users or for security team users?

Response Alerts for all types of alerts.

12. Question

Is MSSP responsible for deploying/managing images for the city?

Response No.

13. Question

What is your current Mobile Device Manager?

Response Windows.

14. Question

Are you requesting that we to take over management of this platform?

Response Please read the RFI-The MSSP vendor is expected to provide the SIEM not the

MDM.

15. Question

Device policies or organizational policies?

Response We will provide organizational policies, but the vendor should provide the MSSP Vendor Provided SIEM system specific policies.

16. Question

Please elaborate on what services and expectations are?

Response No, the information is found in the RFI.

17. Question

Can the City clarify what it means by "hardware" protection?

Response No, this is a request for Information, therefore, please provide information on MSSP for hardware.

18. Question

Please provide additional detail on what the City would like an MSSP to provide during these non-cyber events?

Response If there is a non-cyber disaster such as a Hurricane, the MSSP Vendor, IT and

IT Security will be supporting the City for operating during the event and recovery afterwards.

19. Question

Is the request for the MSSP's employees to complete annual security training? Or does the MSSP need to provide training to the City?

Response The MSSP can provide its own Annual Security Awareness Training.

20. Question

Is City of Atlanta open to exploring non-USA based hybrid options to provide the requested services and solutions? Our clients typically want to leverage this option to get access to our global pool of cybersecurity professionals in a cost-efficient manner.

Response No-US only.

21. Question

Is the City of Atlanta currently using any service providers that are assisting in performing the requested services? And if so, when is the incumbent's MSSP contract set to expire?

Response The question is not relevant. The City is looking to get information on an expanded MSSP service. Please bid on what is in the RFI.

22. Question

Does the City of Atlanta plan to select a single vendor or multiple vendors to provide these services?

Response Single Vendor.

23. Question

What hours of operation would be required? 24/7, 24/5, 16/5 or 8/5?

Response We put this in the RFI- 24/7.

24. Question

What are the compliance mandates you’re required to uphold (FIPS, NIST, HIPAA, PCI, ISO 27001, etc.)?

Response Information is found in the RFI. Please reference Exhibit B attached in the solicitation Scope of Work section.

25. Question

Does City of Atlanta have an On-Prem/Cloud/Hybrid infrastructure?

Response Yes.

26. Question

Are there any EDR/XDR/SIEM/SOAR tools City of Atlanta uses at the present time?

Response In the RFI we stated we want the MSSP vendor to provide the SIEM.

27. Question

Is there an existing Incident Response Retainer service? If not, would you be interested in that service?

Response We are already subscribing to a service.

28. Question

Is the City of Atlanta currently subscribed to any Threat Intelligence feed(s)? If not, would you be interested in this service?

Response We are already subscribing to a service.

29. Question

Bidder is willing to submit a response that sets forth its capabilities in support of the requirements in Exhibit A Scope of Services and Exhibit B MSSP Requirements. Bidder may not be able to respond to all the requirements in Exhibit C Contents of Proposals/Required Submittals in the time available. Will a limited response be considered or rejected?

Response It will be considered however may not be as strong as a vendor who can provide everything.

30. Question

Given the extent of the scope requested in the RFI, will the CoA consider extending the due date two weeks to a revised due date of 4/29?

Response The Informational Proposal due date has been extended to Monday, April 22, 2024.

31. Question

RFI Exhibit D, beginning on p. 3, contains a list of Requested Information. Is Exhibit D the primary document that should be followed for a vendor's RFI Response (rather than Exhibit C)?

Response Please reference:

Exhibit D in which Appendix B provides Physical Locations of City

Systems; and Appendix C provides City of Atlanta Cyber Security Technology as a list of security tools.

32. Question

Exhibit C states the proposal will consist of two (2) separate documents; however, only one item is listed (Informational Proposal). What are the requirements for the second document?

Response An Informational Proposal is comprised of two (2) sources of information:

2.1. Volume I, information drafted and provided by a Proponent; and

2.2. Exhibit B, MSSP Requirements in this RFI (second source of information)

2.3. Exhibit D, MSSP Summary of Appendices in this RFI (second source of information)

33. Question

What is the max page limit for this submission?

Response Please provide what is appropriate to accommodate the request for information.

34. Question

Please provide the preferred format for a cost and price proposal as referenced in item 3.2.3.6 in Exhibit C.

Response This is a Request for Information, if there are any suggestions regarding cost and pricing, please provide that information in the submission.

35. Question

Will the Respondent's delivery personnel be required to be citizens of the United States?

Response YES.

36. Question

Will the Respondent's delivery personnel be required to perform the delivery of the services from locations in the continental United States (CONUS)?

Response YES.

37. Question

Will the solution require the Respondent to manage the incumbent Original Equipment Manufacturer (OEM) solution(s) currently used to perform the Threat Intelligence services?

Response No in the RFI we said the MSSP vendor will manage and provide the SIEM.

38. Question

Equipment Manufacturer (OEM) solution(s) currently used to perform the Vulnerability Management services?

39. Question

Security Incident Response services?

40. Question

Compliance Management services?

Response No-in the RFI the city will procure HW, SW and own the licenses minus the SIEM which the vendor will provide.

41. Question

Will the Service Provider be required to deliver the Executive Briefings onsite at the City's location?

Response Hybrid.

42. Question

Regarding the service exclusion for the "Procurement and Installation of Security Devices" requirement, is it the City's intent to procure and install the security devices, or is the intent of this requirement to exclude the procurement and installation of the security devices from the Service Level Agreements?

Response The city will procure HW, SW and own the licenses minus the SIEM which the vendor will provide.

43. Question

Regarding the service exclusion for the "Network and Infrastructure Design" requirement, is it the City's intent to perform the network and infrastructure design services, or is the intent of this requirement to exclude the procurement and installation of the security devices from the Service Level Agreements?

Response The city will provide the design and systems for the city minus the MSSP vendor

SIEM.

44. Question

Is it the City's intent of this requirement to communicate to the Service Provider that the City would prefer to be billed for the services on a monthly basis delivered as a Monthly Recurring Charge?

Response This is a Request for Information, if there are any suggestions regarding billing, please provide that information in the submission.

45. Question

What is the total quantity of regular service reviews that the Service Provider will be required to deliver to the City per annum (e.g., two (2))? What is the frequency of the delivery of the regular service reviews per annum (e.g., bi-annually)?

Response Bi-Annually.

46. Question

Will the Service Provider be required to conduct the regular service reviews with the City onsite, remotely, or in a hybrid model inclusive of onsite and remotely?

Response The reviews will be Hybrid.

47. Question

Will the Service Provider be required to develop a written information security program (ISP) specifically for the City, or is the intent of this requirement to ensure that the Service Provider has a written ISP specific to the Service Provider's organization?

Response The MSSP Vendor should have an ISP specifically for the service provided to the city.

48. Question

What is the total quantity of Emergency Incident Response activities that will be required per annum (e.g., two (2))? What is the frequency of the Emergency Incident Response activities per annum (e.g., bi-annual)?

Response Bi-Annual.

49. Question

The scope of this requirement numbered "1.1.4” includes the scope required for the "implementation of Managed Security Services."

The requirement numbered "1.3.4" states:

"Service Exclusions: The following services are excluded from the MSSP scope of services:

a) Procurement and Installation of Security Devices: The Service Provider will not be responsible for the procurement or installation of security devices."

Will the MSSP scope of services require the Service Provider to perform the installation and implementation of security devices? If the answer is "Yes," will the implementation and installation of the security devices be excluded from the Service Level Agreement(s)?

Response We expect the MSSP vendor to install-implement their security devices only.

50. Question

Is it the City's intent for the use of the term "vent" to say "event" in the requirent?

Response The word is “event”.

51. Question

Please provide the currency of the hardware, software, and maintenance for the technologies listed in Appendix C, inclusive of the make, model, firmware version, software version, End of Support date, and End of Life date.

Response We have provided our technology list-we will not provide specific make and models.

52. Question

Will the Service Provider be responsible for patching the solutions specific to the assets managed by the MSSP Service Provider (e.g., SIEM), or will the Service Provider also be responsible for patching assets that are outside of the scope of the services managed by the MSSP Service Provider (e.g., servers that are managed by the City's personnel do not host any security solutions)?

Response Yes, to patching the vendor systems.

53. Question

Please provide the desired frequency of reporting for the reports listed in Appendix D that do not have a desired frequency listed in the description.

Response The reports are monthly at a minimum.

54. Question

Is it the City's intent to have the Service Provider provide managed firewall services for Palo Alto Firewalls only, or does the requirement to provide firewall management include Original Equipment Manufacturers (OEMs) in addition to Palo Alto? If the answer to the previous question is "Yes," please provide the name of the OEMs that the City desires to have firewall management services for.

Response In the RFI we requested the MSSP vendor to provide information on managing the City’s Firewalls. We will provide the Palo Alto firewalls.

55. Question

Please provide the total quantity of zones, firewalls, active directory, and scope considered "etc." for the penetration testing.

Response The scope will be the City of Atlanta systems facing the internet.

56. Question

Will the requirement for "on request" vulnerability scanning be included in the pricing as a Monthly Recurring Charge (MRC) or a Non-recurring Charge (NRC)?

57. Response It should be included as a non-recurring charge.

58. Question

Please provide clarity on the document title and Appendix referenced in this requirement. The requirement lists an Appendix name (i.e., Appendix B, but does not reference a document title. Appendix B in the document titled "City of Atlanta RFI_Exhibit D - MSSP RFI Summary of Appendices.pdf" states:

"Appendix B - Physical Locations of City Systems City Hall -55 Trinity Ave, Police Headquarters 180 Peachtree Street, Watershed at 72 Marietta, ATL Airport, 911 center, and DPW trucks mechanical shop."

Appendix C in the same document referenced above provides a list of security tools. Is it the City's intent to reference Appendix C instead of Appendix B?

Response Please reference Exhibit D in which Appendix B provides Physical Locations of City Systems and Appendix C provides City of Atlanta Cyber Security Technology as a list of security tool.

59. Question

What is the City's desired frequency for Awareness and Training per annum? Will the training be delivered onsite, remotely, or a hybrid approach?

Response Security Awareness training is annual, and it can be delivered remotely.

60. Question

For each of the frameworks that are referenced in the requirement, will the City require the Respondent to provide attestation documentation and/or participate in audits from a third party? If the answer to the previous question is "Yes," what is the frequency of the audits?

Response The City follows the NIST framework. We expect our MSSP vendor to do the same. We expect the MSSP Vendor to provide attestation documentation on third party auditing.

61. Question

Is it the City's anticipation to have a new MSSP partner take over the existing licensing for Appendix C - City of Atlanta Cyber Security Technology from the existing provider in a transition phase? Or is the intention to provide net-new software services, less the hardware as indicated in , that the MSSP owns and operates on behalf of the city?

Response The city will procure HW, SW and own the licenses minus the SIEM which the

62. Question

For the pre-existing technologies currently in place:

(a.) Does the City own the title to the hardware, software, and maintenance agreements? As an example, the requirement in Exhibit A Scope of Service, Secton 1.9.3, indicated that the City will grant to the Service Provider a limited, non-exclusive license to use the City Data to perform services.

(b.) The assumption is that the City is the owner of hardware, software, and maintenance agreements; is this a correct assumption?

(c.) Is it the City's intent to transition the ownership of any of the hardware, software, and maintenance agreements for the pre-existing technologies from the City to the MSSP?

(d.) Is it the City's intent to transition the ownership of any of the hardware, software, and maintenance agreements for the pre-existing technologies from the incumbent Supplier(s) to the MSSP?

Response The city will procure HW, SW and own the licenses minus the SIEM which the

63. Question

If the City procures new hardware, software, and maintenance agreements during the Period of Performance (PoP), will the City procure the hardware, sofware, and maintenance agreements and own the title, or will the procurement and ownership be a requirement for the MSSP?

Response The city will procure HW, SW and own the licenses minus the SIEM which the

64. Question

If the City want to procure and/or refresh hardware, software, and maintenance agreements for the pre-existing technologies in place during the Period of Performance (PoP) , will the City procure the hardware, sofware, and maintenance agreements and own the title, or will the procurement and ownership be a requirement for the MSSP?

Response The city will procure HW, SW and own the licenses minus the SIEM which the

65 Question

For the NIST requirement, is it the City's intent reference to this framework to make the Respondent's aware that the City prefers to follow the best practices described by NIST? If the answer to the previous question is "Yes," please provide more details on the specific NIST framework(s) being referenced (e.g., NIST CSF, NIST 800-53, etc.)

The City follows the NIST framework and we expect our MSSP vendor to do the same.

For the NIST frameworks that are referenced, will the City require the Respondent to provide attestation documentation and/or participate in audits from a third party? If the answer to the previous question is "Yes," what is the frequency of the audits?

We expect the MSSP Vendor to provide attestation documentation on third party auditing.

Response Yes, please provide attestation of the audit-the type of audit will dictate the frequency.

66. Question

CyBourn is strongly interested in putting a proposal together for this RFI.

CyBourn has engaged with a lot of clients across the US for very similar engagements to this. However, with some clients, we have run into the problem that the physical location of our SOC is located in Bucharest Romania.

Will the physical location make us ineligible for this project?

Response The location would make you ineligible for this opportunity.

67. Question

Would the primary contractor have the ability to subcontract some of the required services?

Response The vendor can recommend this as part of their offering and it will be reviewed.

68. Question

Will the city be providing the vulnerability management tools? Or already has vulnerability management tools?

o If in the process of acquiring a vulnerability management solution, will the city accept guidance from the primary contractor?

Response The city will offer vulnerability management tools. The city tools are listed in the RFI.

69. Question

Will the MSSP be required to use the city's existing SIEM solution, (if in place)?

Or will the city be acquiring a SIEM solution as part of the contract?

Response We addressed this in the RFI. We expect the MSSP vendor to offer a SIEM as part of their offering.

70. Question

Will the city provide details on any of the existing security controls and IT management solutions to be operated by the contractor?

Response We provided this in the RFI. We would like the vendor to address operating the SIEM and Firewall.