RFI 2027000006, Enterprise Network Security Firewalls (REQ 13413960) V2.pdf

Request For Information EGBA RFI 2027000006

"Network Security and Palo Alto"

All questions and inquiries regarding this solicitation must be sent to:

Mike Whalen, Mike.Whalen@state.co.us

This document is created in Google Docs and should not be converted to Word

INSERT RFI NUMBER

Schedule of Activities

Activity Time Date

Solicitation Publication (VSS) 3:30pm 8/28/2026

Vendor Response Submission Deadline 1:30pm 9/23/2026

Please submit to the following address: http://www.bidnetdirect.com//oit

Table of Contents

Schedule of Activities 1 Table of Contents

Section 1 Request for Information 2

1.1. Market Research Only 2

1.2. Confidentiality 2

1.3. Introduction 2

1.4. Scope of Work 3

a. Core Technical and Architectural Requirements 3

b. Regulatory Compliance & Data Protection Standards 3

c. Hardware, Maintenance, and Support SLA Expectations 4

Section 2 Vendor Response Criteria 5

2.1. Request to Demo Solution 5

2.2. Proposed Submission (Optional) 5

2.3. Market & Pricing Information (Optional) 5

Section 3 General Administrative Information 6

3.1. Colorado Vendor Self Service 6

3.2. Response Submission Information 6

3.3. News Releases and Announcements 6

3.4. Response Material Ownership 6

3.5. Submission of Pricing information 6

3.6. Submission of Confidential or Proprietary Information 6

http://www.bidnetdirect.com//oit

Section 1 Request for Information

1.1. Market Research Only

This is a Request for Information (RFI) and is intended only for market research purposes. In accordance with §24-103-201.5, C.R.S and the associated Colorado

Procurement Rules, this is not a solicitation. No award will result from any response to any vendor responding to this RFI. This RFI is considered formal market research for the purposes of §24-37-302(1) (a.5), C.R.S., if applicable.

1.2. Confidentiality

a. All responses to this RFI shall be considered confidential until after an award based on a subsequent solicitation has been made or until the procurement official from the issuing agency determines that the state will not pursue a solicitation based on this RFI. After such time, the responses to this RFI shall be open to public inspection in accordance with the provisions of the Colorado

Open Records Act. Reference §24-103-201.5(4), C.R.S.

b. The State reserves the right to have information submitted in response to this

RFI be reviewed by other entities within the State for purposes of compiling and analyzing possible options.

1.3. Introduction

The State of Colorado, Governor's Office of Information Technology (OIT), is issuing this Request for Information (RFI) to perform market research and gauge enterprise capabilities for Next-Generation Firewalls (NGFW), & centralized network security management solutions. The focus of this initiative is for dedicated enterprise hardware & network-layer security across OSI Layers 2 through 7 which is separate from endpoint & workstation security software.

OIT shall evaluate technology solutions and strategies for enterprise stability, multi-tenant agency support, predictable lifecycle maintenance, and compliance with federal and state data protection standards. This RFI seeks market research white papers, proposals and budgetary projections from industry-leading enterprise network security vendors.

1.4. Scope of Work

a. Core Technical and Architectural Requirements

i. OSI Layer Inspection: Full Next-Generation Firewall (NGFW) functionality operating seamlessly across OSI Layers 2 through 7, including deep packet inspection, application recognition, vulnerability protection, malware mitigation, and granular data filtering.

ii. Centralized Management: Administrative management system providing unified policy orchestration, configuration management, software update distribution, and threat monitoring across all deployed appliances.

iii. Multi-Tenancy Architecture: Support for hardware virtualization (e.g., multi-context / virtual system architecture) enabling secure logical isolation and hosting of multiple distinct state agencies on single physical firewall hardware platforms.

iv. Remote Access VPN Capacity: Native capacity to support a minimum of

15,000 concurrent remote access VPN users with high performance, scalability, and seamless authentication integration.

v. Dynamic Threat & AI Integration:Support for External Dynamic Lists

(EDLs), automated IP/domain blocklisting, automated threat response workflows, and AI-driven security management integration.

b. Regulatory Compliance & Data Protection Standards

All proposed solutions and hardware platforms must meet strict federal and state regulatory mandates, including:

● Cryptographic Certification: FIPS 140-3 validation for hardware and cryptographic modules.

● Data Protection Frameworks: Comprehensive controls supporting Personally

Identifiable Information (PII), Protected Health Information (PHI), Federal

Tax Information (FTI), and Payment Card Industry Data Security Standard

(PCI DSS) requirements.

c. Hardware, Maintenance, and Support SLA Expectations

Given the critical nature of state infrastructure, vendors must detail their enterprise support frameworks addressing the following key expectations:

● Support Availability: 24/7/365 tier-3 enterprise technical support model.

● Hardware Replacement SLA: Minimum 4-hour Return Merchandise

Authorization (RMA) hardware replacement turnaround time for critical core sites.

● Platform Stability & Upgrade Predictability: High operational stability, rigorous software quality assurance, backward compatibility guarantees, and transparent CVE patch deployment models that eliminate unannounced dependency breakages and emergency off-hours maintenance windows.

● Transparent Licensing & Features: Clear, predictable licensing structures without unannounced paywalls or shifting core features into separate add-on subscriptions.

Section 2 Vendor Response Criteria

2.1. Request to Demo Solution

It is the intention of the evaluation committee to review, consider, and participate in demonstrations from the vendor community. Critically, vendors are instructed to complete the following form in order to be considered responsive. Responsive offering will be contacted to perform a high-level demonstration of their organizations offering:

https://forms.gle/jCyAuFvz1XWVwh6E6

Please note not all vendors shall be selected to demonstrate the company’s offering. Which organizations are selected shall be done so at the sole discretion of internal stakeholders. Vendors who pose to offer the most advantageous value proposition shall be selected.

2.2. Proposed Submission (Optional)

Vendors may submit a formal response, relevant documentation, or additional white papers or marketing materials. Submissions shall be sent through BidNet.

Please note that submissions are not mandatory and are considered optional to this Market Research. Vendors submissions should cover the following key sections:

● Vendor Overview & Enterprise Track Record: Summary of enterprise-grade firewall deployments in state/local government or large enterprise environments.

● Architectural Overview & Feature Matrix: Description of NGFW hardware appliances, centralized management systems, multi-context capabilities, and remote VPN scaling.

● Support & Service Delivery Model: Details of support tiers, RMA SLA fulfillment, release/patch engineering practices, and backward compatibility https://forms.gle/jCyAuFvz1XWVwh6E6

2.3. Market & Pricing Information (Optional)

The state requests non-binding pricing and relevant price models for these services and products. Please describe your licensing structure (e.g., per user, per endpoint, or data volume) and any potential cost points.

Section 3 General Administrative Information

3.1. Colorado Vendor Self Service

This RFI is being published on the Colorado Vendor Self Service page (Colorado VSS) at www.colorado.gov/vss, so that Respondents who have an interest may submit a response in accordance with the terms of this RFI.

3.2. Response Submission Information

Respondents are asked to submit responses via BidNet.com directed to the procurement point of contact identified above. The response submission email should include the subject line: “Response submission from (insert respondent name) for RFI 20270100006 "Enterprise Network Security Firewalls". Responses should be included as one or more attachments of commonly accessible file types.

3.3. News Releases and Announcements

Respondents shall not issue any news releases, communications or announcements of any kind pertaining to this solicitation, without prior written approval by the

State.

3.4. Response Material Ownership

All material submitted in response to this RFI becomes the property of the State.

3.5. Submission of Pricing information

In order to assist the state in gathering information, this RFI may request that

Respondents submit pricing information. Submission of pricing information is not mandatory and such information may be voluntarily included in a response.

3.6. Submission of Confidential or Proprietary Information

a. As per §24-103-201.5, C.R.S, all responses to requests for information are confidential until after an award based on a subsequent solicitation has been made or until the procurement official determines that the state will not pursue a solicitation based on the RFI. After such time, the responses to a RFI shall be open to public inspection in accordance with the provisions of the

“Colorado Open Records Act”, part 2 of the article 72 of this title 24.

b. A Respondent may submit, as a part of its Response, a written request for classification of certain portions of the response as a trade secret or other confidential or proprietary information. Material for which the Respondent is requesting confidentiality shall be readily identifiable and separated from other portions of the response to facilitate public inspection of the non-confidential portion of the response. Commingling of confidential and non-confidential information is not acceptable. Neither price information nor any information that will be included in a resulting Contract or purchase order will be considered confidential.

c. The Respondent must include the rationale for any request to classify portions as a trade secret or confidential or proprietary, including references to the authority that allows for such treatment.

d. A complete redacted response should also be included along with an unredacted Response and confidentiality justification.

e. Except as provided in Section 1.2 above, in no event shall an entire response be classified as confidential. The Procurement Official or his or her designee shall determine if the information identified in the Respondent’s request is exempt from disclosure in accordance with §24-72-204, C.R.S., and shall inform the

Respondent in writing of his or her determination. If the Respondent does not agree with the determination, the Respondent may protest the determination in accordance with article 109 of the Colorado Procurement Code and the terms of this solicitation. Reference Procurement Rule R-24-101-401-03.

Schedule of Activities

Table of Contents