RFI Questions and Answers-Data Security Platform.xlsx
XLSX spreadsheet 48 KB Posted
- Attached to
- Data Security Platform
- Solicitation number
- Not on record
About this file
The document is a Request for Information (RFI) Questions and Answers spreadsheet for a Data Security Platform solicitation by the Department of Justice Federal Bureau of Investigation (FBI) Headquarters Division. The RFI seeks market research information from potential vendors regarding a comprehensive data security platform, with key technical specifications including environment size (8000+ instances at peak), data volume (920TB searchable, 165TB frozen), user count (348), and data ingest rates (6-7 TB average, growing with executive order requirements).
The RFI captures detailed technical parameters across multiple potential vendor responses, including infrastructure configurations (1 server, 20-8 physical hosts with 5 virtual machines), data sources (62-100 sources including database, application, and web servers), and event processing volumes ranging from ~40 million to 682+ million events daily. While the document does not specify precise contract award details, pricing structure, or incumbent information, it provides a comprehensive technical outline to help potential vendors understand the FBI's data security platform requirements and prepare more accurate market research quotes.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| RFI-Data Security Platform.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| Question | Answers | Answers | Answers | Answers | Answers | |
| Can you please tell me if there is an incumbent? If so, can you please share contract information, including value. | N/A | N/A | N/A | N/A | N/A | |
| 1. In order to accurately provide pricing, could you please confirm if the FBI is looking for cost structure or market research quotes? If they need market research quotes could you please provide responses to the following items: | you are welcome to provide both if you please | you are welcome to provide both if you please | you are welcome to provide both if you please | you are welcome to provide both if you please | you are welcome to provide both if you please | |
| a. Environment size | 8000+ instances at peak | 1 server | 20 | 8 Physical Hosts with 5 Virtual Machines. If not answered correctly, please further define. | ||
| b. Amount of data | 920TB searchable, 165TB not searchable (frozen) | 2.8TB | 65TB + | 30 TB | ||
| c. Number of users | 348 | 5 | 18 | 4 | ||
| d. Sample of telemetry sources | various | 62 | 100 | Database server, application server, web server | ||
| e. Current data ingest rates | 6-7 TB average but growing with the executive order | ~40 million events a day | ~682+ million events a day | <5 GB per day | ||
| f. Split of data that’s air-gapped vs. on prem vs cloud | 0% air-gapped, 40% on prem, 60% cloud | cloud air gapped from FBI infrastructure | All Cloud | All On Prem | ||
| 2. From a product capability perspective, could you please provide us more insight into the following? | ||||||
| a. Data & Usage (SIEM): | ||||||
| i.What is your current average and peak data ingestion rate (e.g., Events Per Second (EPS), Gigabytes/day) for your existing SIEM? | 6.5 TB average, 9.2 TB peak in previous month | EPS: AVG 462, MAX: 554, Data: AVG 9.16GB, MAX 10.795. *Not all EO logging is completed yet | EPS: AVG 7,893, MAX: 11,923, Data: AVG 350GB+ | GB per day | ||
| ii.Could you provide a breakdown of your primary log source types and their respective volumes? | Windows/Linux servers, AWS, Azure, home grown applications, purchased applications | Linux Audit: 6GB/Day, Linux Syslog: 1GB/Day, LDAP: 1GB/day, TAK Subscriptions: 1.2GB/Day, Firewall: 1GB/Day, Other < 1GB /Day | Database server, application server, web server | |||
| iii.What is your current data retention policy for SIEM data (e.g., hot, warm, cold storage durations)? | 12 months searchable (hot, warm, cold) and additional 18 months frozen | Currently keeping all data. Current Warm/Hot is 1.6TB, Cold is 968GB | Currently keeping all data | 5 years | ||
| iv.How many active users (analysts, administrators) currently use the SIEM? | 348 | 5 | 5 | 4 | ||
| b. Existing Infrastructure: | ||||||
| i.Could you describe the current hardware infrastructure (servers, storage, network) supporting your SIEM solution? | Index Tier - 60 AWS Servers (48 vCPUs, 384GiB memory), 21 AWS Servers (32 vCPUs, 132GiB memory) | |||||
| Search Tier - 9 AWS Servers (36 vCPUs, 72GiB memory) | one server that serves as indexer and search head. 1x 6TB Disk for _____ on AWS EBS GP3 Volume | Physical servers, network-attached-storage, virtual servers (on-prem and GovCloud) | 10 indexers, 4 search heads, 2 masters | 8 Physical Hosts with 5 Virtual Machines. If not answered correctly, please further define. | ||
| ii.Are there any components of the current infrastructure that are planned to be reused, or are you expecting a full refresh? | All instances are cloud based | N/A | All reused | N/A | No planned refresh in current or upcoming fiscal year | |
| c. Current Challenges & Gaps: | ||||||
| i.Are there any limitations with your current SIEM solution or security analytics capabilities? | lack of administrators | No | None known | No | None | |
| ii.Are there specific capabilities or use cases that the FBI is looking to leverage in the new solution? | Undetermined | Security monitoring, security compliance, infrastructure monitoring, application monitoring | Undetermined | No | ||
| 3. Data & User Growth: | ||||||
| a. What is the anticipated percentage growth in data ingestion volume year-over-year for the next 5 years? | anticipate growing closer to 10TB average as more Cloud base logs are ingested. | 5 to 10% per year as cots software is updated to have all EO14028 logging features logging to ___ | 5-10% | 5 to 10% per year as cots software is updated to have all EO14028 logging features logging to _____ | 1 GB per year | |
| b. What is the projected growth in the number of security analysts or other users who will require access to the SIEM over the next 5 years? | minumal growth. Expect to maintain about the same amount of users | 10 to 20 | 5-10% | 10 to 20 | None | |
| c. Are there any planned new initiatives, system integrations, or expansions (e.g., new departments, cloud services) that will significantly impact data volume or log sources over this period? | cloud logs | Yes | GovCloud ingest rates are somewhat dynamic and could fluxuate to a large degree | Yes | None | |
| 4. Evolving Requirements: | ||||||
| a. Do you anticipate changes to your data retention policies over the next 5 years? | no | No | No | No | No | |
| 5. SIEM Functionality: | ||||||
| a. Beyond core SIEM capabilities (log collection, normalization, correlation, alerting, reporting), are there specific advanced features you require (e.g., UEBA, SOAR, advanced threat hunting tools, specific AI/ML-driven detections)? | machine learning | Not at this time | UEBA and SOAR would be beneficial to the enterprise | Not at this time | No | |
| b. Are there any mandatory third-party integrations (e.g., threat intelligence feeds, ticketing systems, existing security tools)? Please list them. | no | Not at this time | Tenable/Nessus, Defender | Not at this time | No | |
| 6. Deployment & Integration: | ||||||
| a. Will data migration from the existing system be required? If so, what volume of historical data needs to be migrated? | yes, 1,085TB | yes over 3TB of data | Likely not possible | yes over 65TB of data | No | |
| b. What level of assistance do you require for deployment, configuration, and integration with existing tools and workflows? | None other than general tech support when bugs are found in the software | None other than general tech support when bugs are found in the software | Minimal, dependent on vendor | |||
| 7. Training: | ||||||
| a. What are your requirements for initial deployment, ongoing maintenance, and continuous / ad hoc training for administrators, analysts, and other users? | None, since it does not cover contractors and all my staff are contractors | Standard O&M levels of training | None | Minimal, dependent on vendor | ||
| b. Are there other professional services anticipated, such as custom use case development, health checks, or strategic consulting throughout the 5-year term? | yes | No | Yes, all listed would be beneficial to the enterprise | No | Minimal, dependent on vendor | |
| 8. Security & Compliance: | ||||||
| a. Can you detail all applicable security certifications, compliance standards (e.g., FISMA, NIST CSF, CMMC, specific DOJ/FBI directives), and data handling requirements the solution must meet? | FISMA, NIST | FISMA, NIST for data, FIPS for host deployments | FISMA, NIST | FISMA, NIST, DOJ/FBI | ||
| b. Are there any specific requirements for data residency or data sovereignty? | US Only if outsourced. | US Only if outsourced. | Expectation is for all data to remain on prem | |||
| Is FBI seeking information only from manufacturers in response to this RFI, or would you also be interested in potential solutions provided by integrators? | Responses to the RFI should include detailed information on potential software and products and how the FBI could best implement them, as well as potential costs for implementation (e.g., licensing prices). | Responses to the RFI should include detailed information on potential software and products and how the FBI could best implement them, as well as potential costs for implementation (e.g., licensing prices). | Responses to the RFI should include detailed information on potential software and products and how the FBI could best implement them, as well as potential costs for implementation (e.g., licensing prices). | Responses to the RFI should include detailed information on potential software and products and how the FBI could best implement them, as well as potential costs for implementation (e.g., licensing prices). | Responses to the RFI should include detailed information on potential software and products and how the FBI could best implement them, as well as potential costs for implementation (e.g., licensing prices). | |
| Are there preferred standards or existing FBI enterprise tools (e.g., log formats, APIs, databases) the platform must integrate with? | Yes | Yes | Yes | Yes | Yes | |
| What are the expectations around data ingestion throughput and volume (e.g., logs per second or TB/day)? | GB/day | GB/day | GB/day | GB/day | GB/day | |
| What is the expected retention period for security logs and monitoring data? | 5 to 25 years | Baseline 30 months (12 months searchable + 18 months cold able to be retrieved). Some applications requiremuch longer retention for legal obligations. | 5 to 25 years | 5 Years | ||
| Are containerized or Kubernetes-based deployments acceptable or preferred? | NO | Acceptable | NO | Acceptable but not preferred | ||
| Is there a requirement for platform deployment across multiple classification levels (e.g., unclassified, secret, top secret)? | Yes | Yes | Yes | Yes | Yes | |
| Are there FBI-specific security controls in addition to EO 14028 and OMB M-21-31 that vendors must accommodate? | Yes | Yes | Yes | Yes | Yes | |
| Is FIPS 140-3 validated encryption required across the platform? | yes | Yes for the infrastructure deployments | yes | No | ||
| Does the government anticipate a need for the data security platform to support both air-gapped cloud-native deployments (e.g., private cloud or containerized environments) and traditional on-premises air-gapped deployments? | Yes | Yes | Yes | Yes | ||
| Is there an incumbent provider for the current data security platform, or will this be a net-new acquisition? | There is an incumbent provider. | There is an incumbent provider. | There is an incumbent provider. | There is an incumbent provider. | There is an incumbent provider. | |
| Can the Data Security Platform have integrated AI Agents and Agentic Searching present in an air-gapped environment? | NO AI | Yes as long as ther eis no reeachback to the vendor or data lake | NO AI | Yes | ||
| Are there preferred or existing SIEM tools that integration must be demonstrated against? | N/A | As long as the needs are met | N/A | No | ||
| What are the most critical pain points with the current platform that should be addressed in future solutions? Should we put "N/A" here?? | N/A | N/A | N/A | N/A | ||
| Can you identify and prioritize the listed capabilities by categorizing them as essential or discretionary, based on their criticality to mission objectives and overall system effectiveness? | All listed requirements are important to mission objectives. | All listed requirements are important to mission objectives. | All listed requirements are important to mission objectives. | All listed requirements are important to mission objectives. | All listed requirements are important to mission objectives. | |
| What is the estimated ingestion volume (e.g. daily, annual Tb/Gb) of logs, events, and data that the platform will need to process and store? How much of the dailly ingestion is from endpoint data? What is the projected overall growth rate? | Daily up to 30GB, yearly 10+TB, Yearly 17 billion+ events. All Data is from Client logs. | Enterprise wide maybe 40-50TB/day. Expected growth may be 5-10% annually | Daily up to 350GB+, yearly 127+TB, Yearly 250 Trillion+ events. All Data is from Client logs. | Ingest rate of < 5 GB daily with an estimated 1 GB per year growth rate | ||
| With what existing systems (e.g. endpoint, network, identity, cloud) and applications will the data security platform need to integrate with? Can you provide details on these systems and the types of data exchanged? | Linux OS, syslog, custom log files, json logs, log4j type logs, apache logs. | All listed. Integrations with all reporting data is required. | Linux OS, syslog, custom log files, json logs, log4j type logs, apache logs. | Endpoint - Database server, application server, web server | ||
| How many users will be accessing and utilizing the data security platform, and what are their different roles and access requirements? | 350 | 5 - System Owner, System Administrators, ISSO | Auditing, compliance, general users | 5 - System Owner, System Administrators, ISSO | 4 (ITE, ISSO, System Admins) | |
| What are the data retention requirements (e.g. 12 months hot/18 months cold) for logs and security data? Are there specific regulatory or compliance mandates that dictate these requirements? | 12 months searchable (hot, warm, cold) and additional 18 months frozen | 1 day hot, 12 months warm, rest is cold | Baseline 30 months (12 months searchable + 18 months cold able to be retrieved). Some applications requiremuch longer retention for legal obligations. | 1 day hot, 12 months warm, rest is cold | 5 Years | |
| Can you provide more details about the specific requirements and constraints of the air-gapped environments? What level of data synchronization or transfer will be necessary? | Systems with no connection to FBI Internal Networks | Systems with no connection to FBI Internal Networks | ||||
| Is there a preference for a cloud-based, on-premise, or hybrid solution? If cloud-based what FedRamp level? | hybrid, FedRamp High | on-premise, self hosted | Hybrid. Cloud based would be FedRAMP High | on-premise, self hosted | On-premise | |
| Can you provide details about the existing security infrastructure and tools currently in use that are expected to integrate with the data security platform? | N/A | N/A | ||||
| What level of support and maintenance is expected from the vendor? What are the expected service level agreements (SLAs)? e.g. 24*7, on-site, etc. | 24/7 support | What ever current SLA has | 24/7 for critical tickets | What ever current SLA has | ||
| Is multi-tenancy an option for the data security platform? | depends | depends |
| Specific Capabilities: | |||||
| What log types and formats must the data security platform support (e.g., CEF, syslog, JSON)? | any | syslog, json, custom key/value pair | syslog, xml, json, ascii text, binary | syslog, json, custom key/value pair | All standard formats |
| What are the data call / reporting requirements in terms of frequency, format, and delivery methods (e.g., scheduled reports, on-demand, API-based exports)? | scheduled reports, daily, hourly, monthly, yearly. "Real Time alerts" every 15 minutes, delivered by email to admins | scheduled, on-demand | scheduled reports, daily, hourly, monthly, yearly. "Real Time alerts" every 15 minutes, delivered by email to admins | Monthly reporting - scheduled and on demand, API-based desired. | |
| What are the key use cases for security monitoring and data analysis within your environment? | application health monitoring, monitoring for security issues | firewall and user behavour and system processes | Security monitoring, compliance, application and infrastructure health monitoring | firewall and user behavour and system processes | Fulfill key compliance and operational monitoring requirements outlined in NIST 800-53 Revision 5 |
| What are the alerting and health monitoring requirements for the platform, including criteria for alert generation, prioritization logic, and preferred delivery mechanisms (e.g., email, dashboards, APIs, ticketing systems)? | all alerts are delivered by email to admins/isso | dashboards, email alerts, ticketing system | all alerts are delivered by email to admins/isso | Email, dashboards, API | |
| Which applications, systems, or infrastructure components must be monitored for performance, availability, and security in the data security platform? (Endpoint, Network, Identity, Cloud, etc.) | Everything on the EC2 instance, Operating system and all applications | Endpoint, neworking devices, cloud, appliances | Everything on the EC2 instance, Operating system and all applications | Endpoint | |
| What are the specific requirements for security alerting and health monitoring? | being able to setup alerts based on contents of log messages and then email admins/isso with relevant information | being able to setup alerts based on contents of log messages and then email admins/isso with relevant information | Fulfill key compliance and operational monitoring requirements outlined in NIST 800-53 Revision 5 | ||
| What are the auditing and access control requirements, including the need for role-based access and administrative privilege management? | role-base access | RBAC | Fulfill key compliance and operational monitoring requirements outlined in NIST 800-53 Revision 5 | ||
| What specific event types must be logged, and what level of detail is required (e.g., authentication attempts, privilege changes, system configuration updates)? | yes | See EO14028 Requirements | All auditing level events | See EO14028 Requirements | Fulfill key compliance and operational monitoring requirements outlined in NIST 800-53 Revision 5 |
| How is the platform expected to support or integrate with incident response workflows such as alert triage, case management, investigation, ticketing, and playbook automation?" | Currently not being done for TAK system since it is not connected to FBI Network | Integration would be nice for ticketing, playbook automation would be a scripted or api trigger | Currently not being done | ||
| What types of dashboards (e.g. Data Ingestion, Risk Management, Theat Intel Management, Custom, etc.) and ad-hoc search capabilities are required? | Current Dashboards are just system status ones for the previous day or in pseudo real time | All listed | Current Dashboards are just system status ones for the previous day or in pseudo real time | Risk Management Dashboard | |
| Is there a requirement to export data from the data security platform to an external repository (e.g. Dashboard (CDM/DOJ)? | Unknown | None known, why store it twice | Unknown | ||
| What compliance obligations, beyond OMB M-21-31 and EO 14028, must the platform help address (e.g., NIST CSF, NIST 800-53, FISMA, CISA ZT Architecture)? | NIST 800-53, FISMA | All listed | NIST 800-53, FISMA | NIST 800-53, FISMA | |
| Are there any unqiue capabilities or features (e.g. native threat inteligence management, prebuilt playbooks for detection + response. triage and workflow automation, case management, IOC enrichment, etc.) that should be included in the SIEM solution? | N/A | All listed | N/A | Standard capabilities |
| Regarding Data Classification and Handling: | ||||
| What are the specific requirements for data classification and handling of sensitive information within the platform? Are there particular standards or policies (e.g., NIST, internal FBI guidelines) that must be adhered to? | NIST, FBI | FISMA, NIST | NIST, FBI | Unclassified//FOUO |
| Regarding Threat Intelligence: | |||
| What specific threat intelligence feeds does the FBI currently use or plan to use? What are the requirements for the platform to integrate with external threat intelligence providers? e.g. National Vulnerability Database, etc. | N/A | N/A | Not required |
| Are there requirements for the FBI to leverage threat intelligence within the platform (e.g., for proactive threat detection, threat hunting, incident response, vulnerability prioritization)? | N/A | N/A | Yes |
| Regarding User Behavior Analytics (UBA): | ||||
| Does the FBI have specific requirements for User Behavior Analytics? What types of user and asset behavior anomalies or insider threats are of primary concern? | N/A | UEBA would be nice to have | N/A | Best practices for industry |
| What data sources will be available for UBA analysis (e.g., user logs, network traffic, application activity, data center/cloud workload)? | N/A | All listed | N/A | User logs, application activity |
| Regarding Automation and Orchestration: | |||
| SOAR Integration: Does the FBI require Security Orchestration, Automation, and Response (SOAR) capabilities within the platform or is the intent to integrate with existing SOAR tools? If ther later, what SOAR tool would be required to integrate with? | No | SOAR would be nice to have | No |
| Regarding Cloud Security: | |||||
| Does the data security platform need to monitor cloud-based applications or infrastructure? If so, which cloud service providers must it support (e.g., AWS, Azure, Google Cloud Platform, Oracle Cloud Infrastructure)? | AWS and Azure | AWS | Yes - AWS and Azure | AWS | is on-prem |
| Are there specific requirements for securing data and applications in a hybrid cloud environment (i.e., a mix of on-premise and cloud resources)? | N/A | yes | N/A | is on-prem | |
| What cloud compliance authorizations (e.g. FedRAMP) and Federal Guidance and Mandates (e.g., NIST CSF, OMB M-21-31, CDM technical requiements) are required for the data security platform? | FedRAMP,NIST, OMB | FedRAMP HIGH | FedRAMP,NIST, OMB | is on-prem |
| Regarding Attach Surface Management: | |||
| Does your organization plan to consolidate external asset discovery, internal asset telemetry, vulnerability insights, and threat detection into a single analytics and response platform? | no | no | |
| Will the solution need to support continuous asset discovery and risk scoring in alignment with CISA BOD 23-01 or similar exposure management guidance? | no | no | |
| Is there a need to correlate external attack surface data with internal telemetry and threat activity for unified risk scoring and prioritization? | yes | no | no |
| Does the organization require continuous discovery and inventory of all internet-facing assets, including shadow IT, cloud assets, and unmanaged infrastructure? | no | no | |
| Are there requirements to detect and assess unknown or unauthorized assets across all IP ranges, domains, and cloud service providers? | yes | yes | yes |
What level of visibility is required into exposed services, misconfigured cloud resources, and risky ports/protocols across all business units and third parties? yes unknown unknown
| Regarding Mobile Security: | ||
| Are there requirements (e.g. CDM Mobile Threat Defense) to monitor and secure mobile devices used by FBI personnel? | Outside of ___system | No |
Regarding Data Analytics:
Are there requirements for the cybersecurity platform to natively ingest and normalize diverse telemetry sources—such as identity, endpoint, network, cloud, application, and mobile data—to enable unified, proactive threat analysis and response without reliance on multiple external tools? maybe maybe Yes
| Regarding Insider Threat: | |||
| Are there Federal compliance, operational, and security requirements to effectively identify, mitigate, and respond to insider threats, in accordance with directives such as NISPOM, Executive Order 13587, and/or any agency-specific guidelines? | unknown | unknown | Yes |
| Regarding Scalability and Performance: | ||||
| What is the expected growth trajectory for the cybersecurity platform over time, specifically in terms of data ingestion volume, concurrent user access, and processing or compute requirements? | may increase to have more indexers if data expands | Approimaely 5-10% | may increase to have more indexers if data expands | Ingest rate of < 5 GB daily with an estimated 1 GB per year growth rate |
| Cost and Implementation: | |||||
| Are there specific requirement priorities that will be used to guide trade-off decisions in the event of budget constraints for the proposed solution? | yes | yes | |||
| What is the desired implementation timeline for the data security platform once contracted, and what is the target date for full deployment and operational readiness? | depends on what is chosen and the level of effort to stand up / migrate data if even possible | depends on what is chosen and the level of effort to stand up / migrate data if even possible | |||
| Please provide details on the training requirements for the platform, including the expected number of administrators and the level and format of training needed (e.g., online, instructor-led, hands-on labs) to support their roles effectively. | instructor led with hands on labs | instructor led with hands on labs | 4 Users and all training vehicles | ||
| For compliance monitoring and investigative analysis, is there a requirement for the solution to identify and classify sensitive data (e.g., PII, PHI, CUI) across environments to support regulatory mapping or audit readiness? | possible | possible | Yes | ||
| Log Aggregation & Event Logging: | |||||
| Can you specify which log sources (e.g., Windows Event Logs, syslog, cloud platforms) must be integrated? | Windows, Linux, AWS, Azure, syslog, customizable ingestion for various home grown and purchaced applications | Syslog, Linux Applications, Java Applications, AWS Cloud | Linux/Windows, firewalls, web/email gateways, dns, cloud (aws/azure) | Syslog, Linux Applications, Java Applications, AWS Cloud | Yes |
| What are the “specific event types” you require logging for? | All relevant to Eo14028 and for the operation of the system | All relevant to Eo14028 and for the operation of the system | Windows Event Logs, syslogs for application and databases | ||
| Is there a need to track how sensitive data moves across systems or users to identify risks not typically visible through log data alone? | unknown | Yes | unknown | No | |
| In addition to traditional event alerting, is there a need for automated remediation actions, such as applying data sensitivity labels or revoking risky permissions based on continuous monitoring of data security posture? | maybe | SOAR would be in a passive capability if implemented | maybe | Yes | |
| Of the listed compliance mandates (OMB M-21-31, EO 14028), are there specific controls or functional areas (e.g., centralized logging, audit readiness, Zero Trust architecture, etc.) that are the highest priority for this solution? | All are high priority | centralized logging | All are high priority | Yes | |
| Can you provide more detail on how you intend to use dashboard creation and ad-hoc searches. For example, is it primarily intended for real-time threat detection, compliance reporting, investigative analysis, or another specific use case? | yes | all of the above. As well as system statistics. | All listed | all of the above. As well as system statistics. | Real-time threat detection, compliance reporting |
| Can you clarify whether the focus of application performance and monitoring is on infrastructure-level metrics (e.g., servers, network) or on application-level monitoring typically provided by APM tools and are you seeking native capabilities or integration with existing solutions? | infrastructure and application levels are used | all of the above. As well as system statistics. | Both | all of the above. As well as system statistics. | Application performance and monitoring on servers, seeking native capabilities or integration with existing solutions |
| On pages 3 and 4 of the RFI, the Government lists as a requirement, “Application performance and motorizing.” PeopleTec, Inc., interprets this requirement to be “Application performance and monitoring.” Would the Government please confirm that our interpretation of this requirement is correct | Yes? | Yes? | Yes | ||
| Can the government clarify the scope of the requested cost estimate? Specifically, in addition to licensing costs, should the cost estimate reflect implementation services, integration, training, and ongoing support/maintenance? | yes | yes | Yes | ||
| Can the government clarify whether the Data Security Platform is expected to be deployed on-premises or in a government-managed private cloud environment? | on-premises and in a government-managed private cloud environment | on-premise and/or fbi managed private cloud | on-premise and/or fbi managed private cloud | ||
| 1. Current Platform Assessment | |||||
| Can you provide insights into the FBI's current data security platform architecture, including primary vendors, data volumes processed daily, and any integration challenges with existing FBI investigative systems that a new solution should address? | N/A | N/A | N/A |
| 2. Transition Requirements | ||||
| What are the FBI's expectations for data migration and transition timelines from any existing platforms? Are there specific requirements for maintaining operational continuity during implementation, and what downtime windows, if any, are acceptable? | We MUST maintain the existing logs | no downtime is acceptable, all data would have to be migrated. | A migration to another product would take years | no downtime is acceptable, all data would have to be migrated. |
| 3. Incumbent Performance Gaps | ||
| Without naming specific vendors, what are the primary capability gaps or performance challenges in current data security platforms that are driving this requirement? What mission-critical needs are not being adequately met? | None | None |
| Technical Architecture & Requirements | |||
| 4. Air-Gapped Environment Specifications | |||
| Can you provide more specific technical requirements for the air-gapped environment deployment, including network isolation levels, approved data transfer mechanisms, and any special considerations for offline threat intelligence updates? | System that is not connected to internal FBI network infrastructure | System that is not connected to internal FBI network infrastructure | ____ not air-gapped |
| 5. Data Volume & Performance Requirements | ||||
| What are the expected data ingestion volumes (TB/day), retention requirements, and performance benchmarks (search response times, concurrent users) that the platform must support? Are there peak operational periods with significantly higher demands? | ingestion rates should be scalable based on need, retentions needs to 2.5 years in some combination of active/frozen, search times need to be reasonable. Yes there are peak times for ingestion and searching. | 10 to 30 GB / day, retention is currently 5 to 25 years. Search response times should be near instant for recent items. Concurrent search users could be up to 10. | 350 GB / day, retention is currently 5 to 25 years. Search response times should be near instant for recent items. Concurrent search users could be up to 5. | Ingest rate of < 5 GB daily with an estimated 1 GB per year growth rate |
| 6. Integration Ecosystem | ||
| Beyond the stated capabilities, what are the specific FBI systems, case management platforms, or federal partner systems that the data security platform must integrate with? Are there existing APIs or integration standards that must be supported? | no integration | no integration |
| DevSecOps & Innovation Priorities | ||
| 7. DevSecOps Maturity & Automation | ||
| What is the FBI's current DevSecOps maturity level, and what are your expectations for implementing automated security testing, compliance validation, and Infrastructure as Code practices within the data security platform? | Not applicable | Not applicable |
| 8. Stakeholder-Driven Development | ||
| The RFI mentions capability development - to what extent does the FBI expect domain experts (analysts, investigators) to participate directly in use case development, AI model training, and platform customization? What collaboration frameworks are preferred? | N/A | N/A |
| 9. AI/ML & Advanced Analytics | ||
| Beyond traditional SIEM capabilities, what are the FBI's priorities for implementing artificial intelligence, machine learning, and advanced analytics? Are there specific investigative or threat detection use cases that are highest priority for AI enhancement? | No AI | No AI |
| Contract Strategy & Evaluation | ||
| 10. Contract Vehicle Preferences | ||
| While GSA Schedule and HACS are mentioned, does the FBI have a preference for specific contract vehicles? How important is pre-competed pricing versus technical innovation in the evaluation process? | unknown | unknown |
| 11. Evaluation Criteria Weighting | ||
| Can you provide guidance on the relative importance of technical capability, past performance, cost, and innovation in the eventual solicitation evaluation? Will there be separate evaluation phases or a single integrated assessment? | unknown | unknown |
| 12. Small Business Participation | ||
| What are the FBI's expectations for small business participation, including specific socioeconomic categories (SDVOSB, WOSB, etc.)? Are there target subcontracting percentages or prime contractor preferences? | unknown | unknown |
| Implementation & Support | ||
| 13. Implementation Timeline & Phasing | ||
| What is the anticipated timeline from contract award to full operational capability? Are there preferences for phased implementation approaches, and what would constitute minimum viable product for initial deployment? | minimum viable product would be all features and functions of current system fully implemented. | minimum viable product would be all features and functions of current system fully implemented. |
| 14. Training & Knowledge Transfer | |||
| What are the FBI's expectations for training programs across different user levels (analysts, administrators, executives)? Should training programs be customized for FBI-specific operational procedures and investigative workflows? | Training needs to be provided for all who interact / manage the system. Including contractors | Trainings would involve the system administrators to deploy the product, followed by security analysts to monitor the tool, followed by general users/executives. | Training needs to be provided for all who interact / manage the system. Including contractors |
| 15. Performance Management & Success Metrics | |||
| How does the FBI plan to measure platform success? Are there specific KPIs, mission-impact metrics, or operational efficiency improvements that will be used to evaluate contractor performance post-implementation? | Collect all logs and be able to search the logs however needed | That all current use cases are succcessfully replicated and implemented. | That all current use cases are succcessfully replicated and implemented. |
| Security & Compliance | |||
| 16. Compliance Timeline & ATO Process | |||
| What is the expected timeline for security authorization and ATO processes? Are there any FBI-specific security controls or compliance requirements beyond standard FISMA and NIST frameworks that vendors should be aware of? | ATO's take on average 2500+ hours to complete. | ATO's take on average 2500+ hours to complete. | |
| 17. Section 508 & Accessibility | |||
| Beyond standard Section 508 compliance, are there specific accessibility requirements or user experience considerations for FBI personnel with disabilities? Should solutions accommodate specialized assistive technologies? | no | no | Yes |
| Strategic Positioning Questions | |||
| 18. Innovation vs. Proven Technology Balance | |||
| How does the FBI balance the need for cutting-edge cybersecurity capabilities with the requirement for proven, reliable technology? What level of technological risk is acceptable for potential capability gains? | reliable | small risk may be acceptable for gain | small risk may be acceptable for gain |
| 19. Offensive Cyber Integration | ||
| Given the FBI's law enforcement mission, what role should offensive cyber expertise and threat actor understanding play in the defensive data security platform? How important is threat attribution and criminal pattern analysis capability? | n/a | n/a |
| 20. Future Roadmap & Scalability | |||
| What is the FBI's 5-year vision for the data security platform? Are there anticipated capability expansions, additional data sources, or emerging technologies that the platform should be architected to support? | additional data sources will always be added, increased in events and size of data will continue | Some level of automation, perhaps in a SOAR type product for a proactive posture | additional data sources will always be added, increased in events and size of data will continue |
| 1. Prioritization of Capabilities | |||
| Are there specific capabilities among those listed (e.g., SIEM integration, air-gapped support, OMB M-21-31 compliance) that are considered mandatory versus optional? | all are mandatory | M-21-31, EO14028 are mandatory | all are mandatory |
| 2. Component Integration Preferences | ||||
| Does the FBI prefer a fully integrated platform from a single vendor, or is a modular, multi-vendor solution acceptable/preferred? | single vendor | Singular is likely the only possible solution for a holistic approach to monitoring for an enterprise scale deployment. Multiple tools will provide to great of a difference regarding collection and monitoring to be effective. | single vendor | Fully integrated platform from a single vendor |
| 3. Use Case Scenarios | |||||
| Can the FBI provide any sample use cases or operational scenarios to better understand the intended deployment and utilization of the platform? | Collect all logs and be able to search the logs however needed | log aggreation and alerting / reporting done based on information that is in the logs | log aggreation and alerting / reporting done based on information that is in the logs | ||
| 4. OMB M-21-31 & EO 14028 Compliance Specifics | |||||
| Are there specific mappings or controls (e.g., logging event types, retention periods) that must be demonstrated to show alignment with OMB M-21-31 and Executive Order 14028? | must be able to show compliance with the requirements to those who can view the logs but may not know what the log data actuallly represents | collection and storage | must be able to show compliance with the requirements to those who can view the logs but may not know what the log data actuallly represents | Yes |
| 5. Section 508 Compliance Scope | ||
| Does Section 508 compliance apply to all user-facing interfaces or also to administrative and backend components of the platform? | all interfaces | all interfaces |
| 6. Air-Gapped Environment Clarification | ||||
| What level of air-gap support is expected? Full offline operation, delayed syncing, or staged data transfer methods? | any and all need to be supported | any and all need to be supported | ____ is not air-gapped | |
| 7. Deployment Models | ||||
| Is the FBI open to cloud-based or hybrid solutions, or is the preference strictly for on-premises (especially due to air-gapped requirements)? | only FBI hosted whether on-premise or our own private cloud | Both | only FBI hosted whether on-premise or our own private cloud | ___ is on-prem |
| 8. Integration with Existing Infrastructure | ||
| Can you provide any details on existing tools or infrastructure (e.g., current SIEM, log management tools) with which the new platform should integrate? | N/A | N/A |
| 9. User and Role Volume Expectations | ||
| What is the anticipated number of concurrent users or roles (e.g., analysts, investigators, admins) that the solution should support? | 5 to 10 | 5 to 10 |
| 10. GSA/NASA SEWP Priority | ||
| Is there a preference for vendors who can offer the solution via GSA Schedule or NASA SEWP contract vehicles, or will open-market proposals also be considered? | no preference | no preference |
| Expected Timeline for Solicitation | ||
| Is there a target timeline or fiscal year for issuing a solicitation based on this RFI? | unknown | unknown |
| 10. Demonstration Requirements | ||
| Will vendors selected for demonstration be notified prior to a formal solicitation, and will those demos impact future evaluation scores or prequalification? | uknown | uknown |
| 13. Cost Estimation Format | ||
| Is there a preferred format for submitting cost estimates (e.g., itemized per module/license, training, professional services, or bundled solutions)? | unknown | unknown |
| 14. Innovation Encouragement | ||
| Are there areas in the contemplated capabilities where the FBI is particularly interested in innovative, emerging, or unconventional solutions? | possibly | possibly |
| 15. Evaluation Criteria Insight | ||
| Can the FBI provide insight into how RFI responses will be used to shape evaluation criteria or performance metrics in any future solicitation? | unknown | unknown |
Does the FBI have an anticipated timeline for when it would like to begin implementation or migration, depending on the government's preferred approach? as soon as contrat is awarded as soon as contrat is awarded
Can you provide an estimate of the total number of systems and applications included within the scope of this initiative, along with a list of their respective names? 1 system with 12+ servers in air gapped network. 2 system with 300+ servers
Are the systems in question hosted on internal infrastructure or are they cloud-based deployments? on prem and gov cloud internal cloud internal cloud
Does the environment include any homegrown or custom-built applications? yes yes yes
Are the system logs presently aggregated in a standardized format, and are there any events currently being captured or monitored? no, yes most are in standardized formats, all events are captured and monitored most are in standardized formats, all events are captured and monitored
How are the logs generated and where are they stored? Additionally, are the logs maintained in a structured format or as plain unstructured files? Cloud logs, linux/windows logs/events, application logs. There are various structures depending on the data source Logs are generated by Operating Systems and applications. Written to files on the host and then pulled in by agent to send to central log store for long term storage. Some are structured and some are unstructured. Audit logs and system level logs are generated by the endpoint/appliance/device. Logs are generated by Operating Systems and applications. Written to files on the host and then pulled in by agent to send to central log store for long term storage. Some are structured and some are unstructured.
Is the data stored in a structured format (such as a database), or is it primarily unstructured? If unstructured data does exist, where is it stored, and beyond log files, are there other sources or formats in which the data resides. structured Logs on hosts are unstructured text files Structured Logs on hosts are unstructured text files
Are log files(or other data sources) comprised of heterogenous data types within a single file, or are they partitioned and organized by distinct information categories? organized heterogenous and some homogenous Single data type per log file, generally heterogenous and some homogenous
Are there specific data governance policies or constraints in place – for example, those that restrict vendor applications from storing or transferring data for processing or analytical purposes? vender app should not send the data anywhere unless specified by the system administrator data can not leave FBI systems. data can not leave FBI systems.
Are there any expectations or constraints regarding the deployment architecture – for example, a centralized deployment connecting to data sources across departments or projects versus a distributed deployment with dedicated deployment for each department or project. both are valid use cases both are valid use cases
Is there a defined timeline or target date for the delivery and deployment of the solution? as soon as awarded as soon as awarded
How many tools do you need to pivot between logs, SIEM, metrics, endpoint data, etc to investigate a typical security issue? 2 or 3 As few as possible, likely not possible with a singular tool 2 or 3
Are you security and performance data automatically correlated in your current system? yes Yes yes
Do you currently index all of your available potential log sources? How do you decide which logs to retain, archive, or drop? yes all logs are pulled in. Yes yes all logs are pulled in.
Do you require the ability to archive logs into cold storage and hydrate them on-demand? yes Yes yes
| What is the anticipated volume of logs (e.g., events per second, terabytes per day) that the Data Security Platform must handle, and are there specific performance benchmarks for log ingestion and real-time alerting? | 500 to 1000 EPS, 10 to 30GB of data daily | 7000 - 8000 EPS, 350+GB of data daily | ||
| Can the FBI provide details on the specific requirements for air-gapped environments, such as hardware constraints, network isolation protocols, or on-premises deployment preferences | systems that do not have connectivty to other FBI networks | systems that do not have connectivty to other FBI networks | ||
| Could the FBI clarify the scope of application performance monitoring required, including specific metrics (e.g., latency, error rates) or prioritized application types (e.g., web, database) | any type of performance monitoring could be ingested.. CPU Usage, Disk Usage, Memory Useage, JVM Usage, etc. | any type of performance monitoring could be ingested.. CPU Usage, Disk Usage, Memory Useage, JVM Usage, etc. | ||
| What specific Section 508 accessibility standards (e.g., WCAG 2.1 levels, screen reader support) must the platform meet, and are there preferred testing methodologies or documentation formats (e.g., VPAT)? | 508 standards | 508 standards | ||
| Can the FBI specify the event types (e.g., authentication, privilege escalation) and log retention periods required for OMB M-21-31 (EL3 maturity) and EO 14028 compliance, and are there preferred formats for integration with CISA or FBI reporting systems? | all requirements for EO14028 | all requirements for EO14028 | ||
| What level of customization is expected for SIEM dashboards and ad-hoc search capabilities, and are there specific third-party tools or data sources the platform must integrate with? | full customization | full customization, need to be able to also use third party lookups (IP information, external CSV's, etc.) | full customization, need to be able to also use third party lookups (IP information, external CSV's, etc.) | |
| Could the FBI clarify the scope of health monitoring required (e.g., system uptime, resource utilization, network performance) and specify any preferred metrics or monitoring tools? | Any and all monitoring to make sure a system/process is up and running correctly and all attributes about it is monitored, e.g. CPU, Memory, Disk, etc | Any and all monitoring to make sure a system/process is up and running correctly and all attributes about it is monitored, e.g. CPU, Memory, Disk, etc | ||
| Does the FBI prefer procurement through GSA Schedule, or are alternative vehicles like Basic Ordering Agreements (BOAs) acceptable, and if GSA is preferred, which SINs are relevant? | Unknown | Unknown | ||
| What level of detail is required for cost estimates (e.g., breakdown by licensing, training, support; multi-year projections), and are there specific budget constraints or cost categories to prioritize? | Full breakdown for all items | Full breakdown for all items | ||
| Can the FBI provide details on the number and types of stakeholder divisions requiring access to the platform, and are there specific data-sharing protocols or roll-up reporting formats preferred? | multiple stakeholders across the fbi | multiple stakeholders across the fbi | ||
| Does any final solutioning for the envisioned Data Security Platform need to be FEDRAMP compliant? | yes | yes | Yes | yes |
File details come from the government source that posted it. Updated .