RFI Document.pdf

South Dakota Board of Regents 306 East Capitol Ave., Suite 200

Pierre, SD 57501

REQUEST FOR INFORMATION

RFI No. SDBOR 2020-01

MANAGED DETECTION AND RESPONSE

I. BACKGROUND

The South Dakota Board of Regents (hereinafter “SDBOR”) has constitutional authority to govern the system of public higher education in the State of South Dakota. Supported by an Executive Director and staff, the Board provides leadership and sets policies for the programs and services delivered through its six universities and two special schools. The universities and special schools include:

Black Hills State University – Spearfish Dakota State University – Madison Northern State University – Aberdeen South Dakota School of Mines & Technology – Rapid City South Dakota State University – Brookings University of South Dakota – Vermillion School for the Blind and Visually Impaired – Aberdeen School for the Deaf – Sioux Falls South Dakota Board of Regents – Pierre

II. OVERVIEW

SDBOR is soliciting information regarding Managed Detection and Response (hereinafter “MDR”) to serve the needs of the six public universities, two special schools and the SDBOR office in monitoring and responding to network security events. The evaluation will primarily focus on the core services of an MDR solution, but we will also consider MDDR and XDR solutions that align with our requirements.

Specifically, this RFI is to understand the types of MDRs, or related solutions available in the current market and perform an initial evaluation of the functionality, viability, and approximate costs associated with the products and services. Additional information regarding requirements may be found in section IV below.

III. CONTACT INFORMATION

The point of contact for this solicitation is:

Mr. Chris Kolsrud South Dakota Board of Regents Chief Information Security Officer 4801 North Career Ave Sioux Falls, SD 57107 605-367-7594 chris.kolsrud@sdbor.edu

IV. SPECIFICATIONS

1) SDBOR is seeking a MDR as part of our strategic initiative to enhance our cybersecurity defenses. We are seeking detailed information from experienced vendors about their capabilities, technologies, and approaches in providing comprehensive MDR solutions. This RFI intends to gather insights on service offerings, including 24/7 monitoring, real-time threat detection, incident response, and the integration of advanced technologies such as AI and machine learning. Our goal is to understand how these services can be tailored to fit our unique organizational needs and improve our overall security posture.

SDBOR is interested in a MDR that shall include, but not be limited to the capabilities as described below:

Monitoring and Detection

• Implement 24/7 monitoring with advanced analytics for accurate threat identification, minimizing false positives.

o Provide any SLAs associated with expected identification, notification, and response times.

o Identify how your product utilizes retroactive events and the lessons learned from those events across your customer base.

o List cloud environments for your managed detection and response services including compatibility with Azure and AWS.

• Provide a dedicated account manager and 24/7 support with a clear Service Level

Agreement.

• Provide a 24/7 live technical resource.

• Provide continuous monitoring and advanced analysis for threat detection across various vectors utilizing SIEM, SOAR, and AI/ML technologies.

o Define where AI and SOAR will be utilized versus human analysis.

Response Capabilities

• Provide the option for the MDR vendor to perform immediate actions, such as remote containment and investigation.

o Identify and propose opportunities where the vendor's automated response and remediation processes could be utilized.

Event Analysis and Management

• Develop an event analysis framework prioritizing events by criticality and severity for timely responses.

• Assist with the development of analytic rulesets, threat hunting queries, playbooks, and security modeling.

Communication and Collaboration

• Establish protocols for notifying IT security teams about incidents, fostering seamless collaboration between MDR providers and IT staff.

• Coordinate with university staff to create structured processes for rapid incident response for threat isolation, neutralization, and system restoration, complemented by comprehensive post-incident reports.

Workload Optimization

• Shift management of low-fidelity alerts to the MDR provider, allowing focus on high-priority, in-depth events.

• Provide relative information to help identify ROI for the possibility of offloading work from IT staff to the MDR provider.

Advanced Threat Hunting

• Utilize proprietary techniques to identify and mitigate threats before they become vulnerabilities.

• Supply tailored threat intelligence informed by global sources, specific to the industry's threat landscape.

• Provide threat intelligence solutions that are propriety to your vendor solution and could differentiate your product from other solutions.

o Identify how can your vendor solution utilizes collected threat intelligence, analysis, and notifications to address risks across the South Dakota Board of Regents system.

o Provide any industry specific intelligence for higher education.

Flexible Expert Services

• Provide on-demand expert services like digital forensics without extensive searches or contracts.

Tool Efficacy Enhancement

• Enhance existing security tools' outcomes through advanced integration and analytics.

Agile and Innovative System Design

• Create a solution adaptable to security landscape changes, ensuring long-term effectiveness.

• Provide a segmented tenant solution that all 7 entities within the Board of Regents System can utilize effectively without crossing over information and allowing for unique configurations and processes.

Reporting and Analytics

• Regularly report on security trends, incidents, and overall security posture with advanced analytic tools for pattern recognition and threat prediction.

• Industry related performance/analysis - How do we compare to other higher education customers?

2) Technical Requirements Standard System Integration Sources

• Microsoft Defender for Endpoint

• Microsoft Sentinel/Lighthouse o Bidirectional sync

• Microsoft Defender for Cloud

• Cisco Umbrella

• Cisco Firepower

Integration Requirements

• Integrate with listed standard security tools and other log sources for comprehensive threat detection and response.

• Specify seamless log ingestion, data normalization, and efficient data transmission to the analytics platform.

• Demonstrate correlation and analysis capabilities across all platforms.

• Automate responses where appropriate, leveraging integrated tool intelligence.

• Comprehensive reporting and dashboards presenting actionable intelligence.

• Ensure compliance and maintain audit trails using data from integrated tools.

• Provide vendor expertise and certifications for the listed products, and track record in deploying and managing complex security environments.

V. RESPONSE

1) SDBOR is requesting a response that would provide the best fit for the SDBOR’s requirements as described in this RFI. The response should include both technical and non-technical information that the SDBOR would use in understanding different types of managed detection and response solutions available in the marketplace, and the requirements for implementing such a system. Address minimum and optional capabilities as described in Section IV above.

2) Please provide your response to this RFI in pdf format, by 3:00 p.m. Central

Time, Friday, June 28, 2024, by emailing chris.kolsrud@sdbor.edu.

VI. PRICING

Please provide a 3 and 5-year cost estimate to support our use of the proposed solution for the SD BOR system.

Provide Individual pricing, if applicable, on the following areas: subscriptions; per-device pricing; per-user pricing; volume-based pricing; alert-based pricing; tiered service levels;

incident-based pricing; performance-based pricing; or other costs required to add-on services and customizations.

mailto:chris.phillips@usd.edu

VII. PRODUCT DEMONSTRATIONS

1) SDBOR may request product demonstrations based on the information received, therefore not all respondents may be invited to provide a demonstration. Demonstrations shall be online and allow multiple users to view the presentation.

2) Please provide three references (including contact information) for implementations completed within the last two years.

VIII. QUESTIONS

SDBOR requests all questions be submitted via email, no later than Friday, June 14, 2024, to chris.kolsrud@sdbor.edu. Responses to all questions will be distributed to all who are interested. SDBOR reserves the right to reject or deny any requests(s) made by potential respondents. Impromptu, oral questions are permitted, but are only intended as general direction and will not represent official SDBOR position.

IX. USE OF INFORMATION

1) SDBOR, at its sole discretion, may or may not issue a related solicitation or issue multiple solicitations based on the responses to this RFI.

2) All material and information provided to SDBOR in response to this RFI shall upon receipt become the property of SDBOR and shall not be returned.

3) By submitting a response, the respondent agrees that SDBOR may copy the response for purposes of facilitating SDBOR’s review or use of the information. The respondent also acknowledges that such copying will not violate any copyrights, licenses, or other agreements with respect to the materials submitted in accordance with SDBOR’s intended use.

4) SDBOR is not responsible for any costs incurred by the respondent that are related to the preparation or delivery of the response, or any other activities of the respondent related to this

RFI.

X. ADDITIONAL QUESTIONS

1) Monitoring and Detection

a. How do you ensure 24/7 monitoring with advanced analytics for accurate threat identification while minimizing false positives?

i. What are the SLAs associated with identification, notification, and response times?

ii. Can you explain how your service utilizes retroactive event analysis to learn from past incidents across your customer base?

b. What can we expect regarding service management?

i. Can you describe the role and availability of a dedicated account manager?

ii. What are the specifics of a live technical resource? Are they provided 24/7?

How does this integrate with your overall service delivery?

c. Detail where AI, SOAR, and SIEM technologies are utilized versus areas where human analysis is predominant.

d. Automated Response and Remediation:

i. What immediate actions can your MDR service perform autonomously, such as remote containment and investigation?

ii. How can automated processes be leveraged in your response and remediation strategies?

e. Describe the event handling process.

i. How do you prioritize events by criticality and severity? What framework supports this process?

ii. What is your incident escalation process? How are different types of incidents prioritized and handled?

iii. What tools and technologies are used during the incident response and what roles do automation and orchestration play?

iv. What protocols are established for notifying IT security teams about incidents?

v. How do you ensure seamless collaboration between your MDR staff and university IT staff during and after an incident?

vi. How do you manage low-fidelity alerts to allow our IT staff to focus on more significant, high-priority events?

f. How do you ensure the minimization of false positives and false negatives?

2) Service Offerings

a. What information and metrics do you provide to help determine the ROI of offloading certain IT responsibilities to your MDR service?

b. What information and metrics do you provide to qualify the need for MDR services as it relates to the reduction of risk and potential incident related costs?

c. Can you provide examples of how your tailored threat intelligence has benefited other customers, specifically higher education institutions?

d. Do you provide on-demand expert services? If you do, how do you ensure these services are provided efficiently without extensive searches or contracts?

i. Digital Forensics

ii. Incident Response planning and testing

iii. Data governance and DLP controls and services

e. How can you enhance the outcomes of existing security tools utilized by SDBOR through integration and advanced analytics?

i. Describe how your solution adapts to changes in the security landscape.

ii. How do you assist in the development of analytic rulesets, threat hunting queries, playbooks, and security modeling?

f. Does your solution offer a segmented tenant solution that accommodates all 7 entities within the Board of Regents System without information crossover?

g. How do you assist clients in meeting specific regulatory compliance standards relevant to their industry (e.g., FERPA, HIPAA, GLBA, Cyber Insurance)?

i. What documentation do you provide to support compliance audits?

h. How flexible are your services in terms of customization to specific client needs and security policies?

i. Can clients modify or request specific security measures that align with their internal practices or sector-specific risks?

3) Analytics and Reporting

a. Describe your analytics and reporting standards.

i. How frequently do you provide reports on security trends, incidents, and overall security posture?

ii. What advanced analytic tools do you use for pattern recognition and threat prediction?

iii. What customer specific reporting do you provide, including dashboards?

iv. What metrics do you provide to evaluate the effectiveness of your monitoring and response?

v. How are these metrics monitored and reported to the client?

b. What specific assurances do your SLAs provide regarding system uptime, data accessibility, and support response times?

i. What metrics do you provide to evaluate the effectiveness of your monitoring and response?

ii. How are these metrics monitored and reported to the client?

iii. How are SLA breaches handled, and what compensations are offered to clients?

4) Technical Capabilities and Infrastructure

a. How does your solution’s performance compare to other MDR providers in terms of core service components and services?

b. What integrations can you provide into existing technologies?

i. Can you provide detailed examples of how your services integrate with our identified systems, including Sentinel and Microsoft Defender for Endpoint?

c. What are the common challenges faced during the integration process and how are they mitigated?

d. How does your solution secure cloud environments? What tools and strategies do you employ for cloud-specific threats?

i. How do you manage security across multi-cloud environments?

e. Can you provide more details on how AI and machine learning are applied within your service? For instance, how do these technologies aid in anomaly detection and decision-making processes?

i. What measures are in place to continually train and update the AI models to adapt to evolving threats?

ii. What guardrails are in place around your AI solution to maintain security and confidentiality of SDBOR information?

f. Could you explain your approach to behavioral analysis and anomaly detection?

i. How do these capabilities help in identifying sophisticated cyber threats that do not match known signatures?

g. Can you describe your forensic analysis capabilities? What types of digital evidence can you analyze?

i. How do you handle and secure logs and other data that might be used in legal proceedings?

5) Security

a. How do you ensure the security and privacy of our data in your systems?

i. Provide compliance certifications (SOC-2 Type II, ISO 27001, etc.) or any third-party security assessments.