RFI DMS-2526-244 - FLDS - Telemetry Indexing and Querying Solution.pdf

4050 Esplanade Way Tallahassee, FL 32399-0950

Ron DeSantis, Governor

Tom Berger, Interim Secretary

THE STATE OF FLORIDA

DEPARTMENT OF MANAGEMENT SERVICES

REQUEST FOR INFORMATION (RFI)

TELEMETRY INDEXING AND QUERYING SOLUTION

RFI No. DMS-25/26-244

I. INTRODUCTION

The Department of Management Services (Department) is issuing this Request for Information (RFI) to Florida’s vendor community to obtain industry information regarding Telemetry Indexing and Querying Solution. This is an RFI as defined in section 287.012(22), Florida Statutes (“F.S.”), for planning purposes only. This is not a solicitation for offers, the RFI is used as a fact-finding tool.

II. PURPOSE OF AN RFI

Rule 60A-1.042, Florida Administrative Code (F.A.C.), provides that an agency may request information by issuing a written RFI. Agencies are authorized to use an RFI for research to determine any or all of the following: whether to competitively procure particular commodities or contractual services; which solicitation process to use for a particular need; or general, special, or technical specifications to be included in a solicitation.

A vendor’s response to an RFI is not an offer and the agency may not use the vendor’s submission to justify a contract with that vendor without otherwise complying with Chapter 287, F.S. Vendors submitting a response to an agency’s RFI are not prohibited from responding to any related subsequent solicitation.

III. GOALS

The Florida Digital Service (FLDS) is seeking information from vendors regarding solutions capable of indexing and querying large volumes of operational and cybersecurity telemetry data.

Information should be provided about scalable solutions that may be purchased or licensed by FLDS and deployed within the FLDS security environment to support the State of Florida’s Security Operations Center (SOC).

The solution should enable FLDS to query telemetry data originating from a variety of technology sources including network infrastructure, cloud environments, security tools, and enterprise applications. The platform should enable FLDS SOC analysts to efficiently search, RFI No.: DMS-25/26-244 Page 2 of 9 correlate, and analyze telemetry data to support threat detection, incident response, cybersecurity investigations, and operational monitoring across the enterprise.

Primary users of the platform include FLDS SOC analysts, cybersecurity engineers, incident responders, and threat hunters responsible for monitoring and protecting the State of Florida’s enterprise information systems.

Information regarding the telemetry indexing and querying solution should include the following:

a. The solution’s architecture, dependencies, and integrations.

b. The solution’s ability to normalize and/or index data provided by multiple state agencies and systems.

c. The solution’s ability to support rapid querying, correlation, and analysis of large telemetry datasets by the FLDS SOC.

d. The solution’s ability to support enterprise cybersecurity monitoring

IV. BACKGROUND

The Florida Digital Service (FLDS) serves as the State’s central cybersecurity authority and threat intelligence clearinghouse, responsible for coordinating the identification, response, and mitigation of cybersecurity threats impacting state agencies. Pursuant to section 282.318, Florida Statutes, FLDS operates and maintains the State Cybersecurity Operations Center (SOC), which provides enterprise-level monitoring, detection, and support for agency incident response capabilities. In support of this mission, FLDS receives and analyzes telemetry data from multiple agencies and technology environments to identify threats and vulnerabilities across the State. As the volume, velocity, and variety of telemetry data continue to increase, FLDS is evaluating solutions that enable efficient indexing, querying, and analysis of cybersecurity data.

V. OBJECTIVE

The Department desires to obtain information on Telemetry Indexing and Querying Solution.

The Department’s objective’s in acquiring this industry information includes, but is not limited Response

A. Platform Specifications

Describe the Vendor’s telemetry indexing and querying platform specifications, including the platform’s ability to meet or exceed the contemplated functional and technical capabilities, including the ability to:

a. Provide mechanisms for consistent analysis across multiple data sources.

b. Provide efficient indexing mechanisms enabling rapid retrieval and querying of telemetry data across large datasets.

c. Provide high availability, redundancy, and fault tolerance to ensure continuous

SOC operations.

d. Provide powerful search capabilities enabling FLDS SOC analysts to construct complex queries across telemetry data.

RFI No.: DMS-25/26-244 Page 3 of 9

e. Support advanced analytics including statistical analysis, anomaly detection, and correlation of security events.

f. Provide query performance optimization capabilities for large-scale telemetry datasets.

g. Provide dashboards and visualization capabilities to support SOC monitoring and cybersecurity investigations.

h. Support customizable reporting for operational monitoring, threat detection, and incident response activities.

i. Support alerting capabilities based on query results or defined detection conditions.

j. Support secure management of telemetry data received from multiple agencies while enabling centralized analysis by FLDS SOC personnel.

k. Provide role-based access controls to restrict access to administrative and analytical functions.

l. Provide mechanisms to support segregation or tagging of telemetry data by agency or source where required.

B. Integrations

a. Provide a list of current integrations supporting data indexing capabilities

b. Provide a list of known future integrations supporting data indexing capabilities

C. Implementation

a. Provide a clear implementation plan and required resourcing, including setup, testing, and training to support deployment within the FLDS environment.

b. Describe the vendor’s ability to provide training for FLDS system administrators and SOC analysts using online and offline mediums.

D. Dependencies and Supporting Technologies

Provide information regarding any external technologies, infrastructure components, or third-party services required to fully deploy, operate, or leverage the maximum capabilities of the proposed telemetry indexing and querying platform.

Include descriptions of any dependencies that are not natively included within the core platform offering but are required for full functionality, scalability, or performance optimization.

The Department requests information regarding the following:

a. Identify any third-party software, services, or libraries that must be deployed or licensed separately in order to enable key capabilities of the solution.

b. Describe whether the platform relies on or requires integration with specific cloud services, infrastructure platforms, or storage systems in order to achieve optimal performance or scalability.

RFI No.: DMS-25/26-244 Page 4 of 9

c. Identify any components that are optional but recommended by the vendor to achieve maximum functionality, performance, or reliability.

d. Provide information regarding minimum infrastructure requirements, including computer, memory, storage, and networking considerations required to support production deployments.

e. Identify whether the platform requires additional software components for query acceleration, indexing, caching, or analytics processing.

f. Identify whether any required or recommended components introduce additional licensing costs or operational overhead beyond the core platform.

g. Provide architectural diagrams illustrating the complete solution architecture, including all required dependencies and supporting technologies.

h. Identify any external tools, platforms, or integrations required to support detection engineering workflows, including but not limited to detection rule development, testing, version control, deployment, and lifecycle management. Describe whether the platform integrates with or requires external version control systems (e.g., Git-based repositories), CI/CD pipelines, or other tooling to manage detection logic and rule updates.

E. Customer Support

Please provide information on the level of Customer Support provided with the solution, such as:

a. Level of user and technical support available (e.g., 24/7).

b. Access to support across multiple formats including phone, email, chat, and online knowledge bases.

c. Change management and routine maintenance processes.

d. The range of service level agreements (SLAs) available including metrics for:

i. Platform availability

ii. Query performance

iii. Issue resolution timelines

iv. Incident response

F. Solution Security

Please provide information on solution security including the vendor’s ability to provide:

a. A third-party security audit within the past year by an accredited auditing firm and/or demonstrate FedRAMP or StateRAMP status as authorized, in-process, ready, or other.

b. Security policies and procedures governing the solution.

c. Descriptions of configurable controls that extend data and transaction security to hosting providers or integrated platforms.

d. Descriptions of system and application logging capabilities that record configuration changes including:

i. User identity

RFI No.: DMS-25/26-244 Page 5 of 9

ii. Timestamp

iii. Action performed

e. Descriptions of encryption mechanisms for data at rest and in transit.

f. Compliance with relevant security standards and frameworks to protect sensitive government data.

G. Data Residency, Sovereignty, and Support Location

The Department requires transparency into whether any data or support services are performed outside of the United States.

The Department requests information regarding the following:

a. Identify whether any customer data, telemetry data, metadata, or system-generated data is stored, processed, or transmitted outside of the United States.

If so, specify:

i. The countries where such data is stored or processed

ii. The types of data involved

iii. The conditions under which data leaves the United States

b. Describe the solution’s ability to ensure that all data remains within the United

States, including any configuration options or controls available to enforce data residency requirements.

c. Identify whether any remote access to customer data or systems (including administrative, operational, or support access) is performed from locations outside of the United States. If so, specify:

i. The countries from which access may occur

ii. The roles or personnel with such access

iii. The purposes for which access is performed

d. Describe the controls in place to restrict, monitor, and audit access to data, including access originating from outside of the United States.

e. Identify whether any support services (e.g., technical support, customer support, engineering, or maintenance) are provided from locations outside of the United

States. If so, specify:

i. The countries where support personnel are located

ii. The types of support services provided

iii. Whether support personnel may access customer environments or data

f. Describe the vendor’s policies and procedures regarding data sovereignty, cross-border data transfer, and compliance with applicable U.S. laws and regulations.

g. Identify any subprocessors, subcontractors, or third-party service providers that may store, process, or access data outside of the United States.

h. Describe the ability to provide U.S.-only support personnel and U.S.-based data handling as part of the service offering, including any associated cost implications.

H. Pricing & Procurement Factors

Describe all available licensing and pricing models offered for the solution.

RFI No.: DMS-25/26-244 Page 6 of 9

a. Describe whether pricing is based on subscription, consumption-based, perpetual licensing, or hybrid models.

b. Identify any pricing tiers associated with data retention, storage classes, or archival capabilities.

c. Describe any additional costs associated with enabling advanced capabilities such as analytics, alerting, machine learning, detection development, or integrations.

d. Identify any cost considerations related to infrastructure requirements, including computer, storage, networking, or cloud service dependencies.

e. Describe whether the solution includes usage controls, quotas, or cost management capabilities to help manage or limit operational expenses.

f. Identify any additional fees associated with implementation services, training, support, or ongoing maintenance.

g. Identify any existing reseller partnerships and contract vehicles, including cooperative purchasing agreements where the solution may be purchased.

I. Additional Capabilities

Identify additional capabilities beyond telemetry indexing and querying that may support FLDS SOC operations, such as:

a. Threat detection and analytics

b. Threat hunting capabilities

c. Automation and response workflows

d. Observability or operational monitoring

J. Additional Information

Provide any additional information for consideration. Where possible, use a question-and-answer format.

K. References

Provide testimonials or references from current customers, preferably including government or large enterprise SOC deployments.

L. Company information:

a. Primary Contact

b. Address

c. Phone

d. Email

M. Product and services summary:

a. Please provide a general description of the products, services, and technologies offered by your company related to Telemetry Indexing and Querying.

b. Please describe common benefits and outcomes as well as potential issues and concerns relating to Telemetry Indexing and Querying.

RFI No.: DMS-25/26-244 Page 7 of 9

c. Please describe your customer service model and how your company approaches dispute resolution.

N. Additional Information

a. Please provide additional information for consideration. Where possible, use a question-and-answer format.

PLEASE NOTE: Any submitted material is subject to the Public Records Act, section

119.07 of the Florida Statutes.

VI. RESPONSE SUBMISSION

Responses must be submitted in both Microsoft Word and as a .pdf via email to the Department at DMS.Purchasing@dms.fl.gov., by the required date and time in Section VIII, Timeline. Additionally, a redacted copy should be submitted, if necessary (see Section X, Confidential, Proprietary or Trade Secret Information, for additional information).

VII. PROCESS

1. Responses to this RFI will be reviewed by the Department for informational purposes only and will not result in the award of a contract.

2. Responding to the RFI does not prevent a vendor from being eligible to contract with an agency pursuant to section 287.057(19)(c), Florida Statutes.

3. Any request for cost information is for budgetary purposes only.

4. Presentation(s) and Proofs of Concept(s). After the Department receives responses to this RFI, and at the sole discretion of the Department, one or more vendors may be contacted for further information and/or selected to demonstrate to the Department the products and services related to the information submitted in the RFI response. The purpose is for the Department to learn about the most current solutions available.

a. Any presentation should be direct in nature and remain on topic. The presentation moderator will remind vendors that the meeting is for information gathering only and should not take on a sales tone.

VIII. TIMELINE

Listed below are important dates and times when actions should be taken or completed. If the Department finds it necessary to update any of the dates and, or times noted, it will be accomplished by an addendum to the RFI. All times listed below are in Eastern Standard Time (EST) in Tallahassee, Florida.

Date Time

4/6/2026 -. Release of RFI 4/10/2026 3:00 p.m. Questions due to DMS.Purchasing@dms.fl.gov

4/15/2026 Answers to vendor questions are posted to VIP

5/4/2026 4:00 p.m. Responses are due to DMS.Purchasing@dms.fl.gov

RFI No.: DMS-25/26-244 Page 8 of 9

TBD TBD Presentations/POCs, if applicable

IX. RFI QUESTIONS AND CONTACT WITH DMS

Vendors shall address all questions regarding this RFI in writing to the Department at DMS.Purchasing@dms.fl.gov. The Department will post answers to questions on VIP as noted in Section VIII, Timeline.

***ALL EMAILS SHALL CONTAIN THE RFI NUMBER IN THE SUBJECT LINE OF THE

EMAIL***

X. CONFIDENTIAL, PROPRIETARY OR TRADE SECRET INFORMATION

Article 1, section 24, Florida Constitution, guarantees every person access to all public records, and section 119.011, F.S., provides a broad definition of “public record.” As such, the entirety of the responses are public records and are subject to disclosure unless exempt from disclosure by law. If the vendor considers any portion of its response to be Confidential Information, the vendor is to mark the document as “confidential” and simultaneously provide the Department with a separate, redacted copy of its response. For each portion redacted, the vendor is to briefly describe in writing the grounds for claiming exemption, including the specific statutory citation for such exemption. On the cover of the redacted copy, the vendor is to provide its name and the RFI name and number and clearly title it, “Redacted Copy.”

Only portions of material that the vendor claims are Confidential Information are to be redacted.

In the event of a request for public records pursuant to Chapter 119, F.S., the Florida Constitution, or other authority, to which documents that are marked as “confidential” are responsive, the Department will provide the redacted copy to the requestor. If a requestor asserts a right to the redacted Confidential Information, the Department will notify the vendor such an assertion has been made. It is the vendor’s responsibility to take the appropriate legal action to assert that the information in question is exempt from disclosure under Chapter 119, F.S., or other applicable law.

If the Department becomes subject to a demand for discovery or disclosure of documents that are marked as “confidential” in a legal proceeding, the Department will give the vendor notice of the demand or request. It will be the vendor’s responsibility to take the appropriate legal action in response to the demand and to defend its claims of confidentiality. If the vendor fails to take appropriate and timely action to protect the materials it has designated as Confidential Information, the Department will provide the unredacted materials to the requester.

By submitting a response, the vendor agrees to protect, defend, and indemnify the Department for all claims arising from or relating to the vendor’s determination that the redacted portions of its response are Confidential Information. If a vendor fails to submit a redacted copy in accordance with this section, of information it claims is Confidential Information, the Department is authorized to produce the entire material submitted to the Department in response to a public records request for, or demand for discovery or disclosure of, these records.

RFI No.: DMS-25/26-244 Page 9 of 9

XI. VENDOR COSTS

Vendors are responsible for all costs associated with the preparation, submission, and any potential meeting to discuss this RFI. The Department will not be responsible for any vendor related costs associated with responding to this request.