RFP_358696_ATTACHMENT 4_SOLUTIONS_Requirements.xlsx
XLSX spreadsheet 42 KB Posted
- Solicitation number
- RFP_358696
About this file
This document is a Request for Proposal (RFP) issued by the Fermi National Accelerator Laboratory (Fermilab), which is a Department of Energy facility, for a Cloud Access Security Broker (CASB) solution. Fermilab is seeking a CASB solution that will add an additional security layer between users and cloud applications, provide centralized tools to manage cloud application policy and authentication, and improve visibility into Fermilab's cloud environments.
The RFP contains detailed technical and functional requirements for the CASB solution, including capabilities around cloud service discovery, risk scoring, user activity monitoring, authentication enforcement, integration with existing security tools, data loss prevention, and reporting. Bidders are required to provide responses indicating whether each requirement is a current standard offering, a future offering, requires customization, or is not applicable. The RFP also requests information about the bidder's company, technical solution deployment, security and authorization, training, system configuration and administration, and cyber security certifications.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions
RFP XXXXXX
Instructions and Guidelines for RFP Response
| Fermilab would like to enter into a strategic partnership to support its Cybersecurity Procurement project. |
| The following elements contained within this document outline Fermilab's expectations for such relationship. |
| Respondent should indicate its acceptance to operate within these parameters, or otherwise indicate an alternative method of operation. |
| If additional space is needed, Respondent should attach as part of submission. |
| Overview: |
| Tab 1: Company Information asks for general informaiton regarding Bidder's company and business operatoinss |
| Tab 2: Technical Requirements asks for bidder's technical capabilities to meet Fermilab's security and operational requirements. |
| Tab 3: Functional Requirements details specific criteria that the Fermilab stakeholder team and executive leadership have identified as critical for a successful solution. |
Company Information
| RFP XXXXXXX |
| Please respond to the questions below using the space provided. If an attachment is needed in order to provide a complete response on a question, please reference the name |
of the attachment in the response field.
| Ref # | Company Overview | Response |
| CO-001 | Bidder Point of Contact Name: | |
| CO-002 | Title: | |
| CO-003 | Company Name: | |
| CO-004 | Address: | |
| CO-005 | Desk phone: | |
| CO-006 | Mobile phone: | |
| CO-007 | E-mail address: | |
| Company Information | Response | |
| CI-001 | Full company office name and address: | |
| CI-002 | Website address: | |
| CI-003 | Any parent or holding company: | |
| CI-004 | Corporate overview and structure including information regarding any strategic relationships with other related suppliers: | |
| CI-005 | Whether XX is an existing customer or client: | |
| CI-006 | How large is the firm and how many employees currently work there (excluding independent contractors)? | |
| CI-008 | Is your company publicly or privately held? | |
| CI-009 | What is your annual revenue? | |
| CI-010 | Is your firm a U.S company? | |
| CI-011 | What US Locations do you have? | |
| CI-012 | Are your operations and support based in the U.S? |
Technical Requirements
| Supplier Technology Profile |
| INSTRUCTIONS: Please respond to the questions below using the space provided. If an attachment is needed in order to provide a complete response on a question, please reference the name of the attachment in the Supplier |
response field so we can match it up to the correct question when reviewing responses.
| [Bidder Name] | ||
| Ref # | Question | Response |
| Account Management | ||
| TR-001 | Please identify the main account management representatives, including senior management in the event escalation is required. | |
| Solution Deployment | ||
| TR-002 | How many hours of implementation services are included? (Note: if additional T&M hours are required, pricing should be attached/provided). | |
| TR-003 | Are implementation services completed by staff or a third party vendor? | |
| TR-004 | What is the minimum implementation time in hours? | |
| TR-005 | What is the maximum implementation time in hours? | |
| TR-008 | Describe your standard instance deployment structure. | |
| TR-009 | Does the solution offer a mobile platform? If so, is it compatible on both iOS and Android? | |
| Security and Authorization | ||
| TR-011 | If Bidder's solution is SaaS, is it at a minimum FedRAMP moderate certified? |
If yes, what level of certification?
| TR-012 | Does the solution employ encryption methods and protocols for data-at-rest and data-in-transit? If so what are they/to what level? |
| TR-013 | Does the solution meet or exceed security requirements for storing CUI information/documents? |
| TR-014 | Does the solution support multi-factor authentication (MFA)? |
| TR-015 | Does the solution support Single Sign-On with Okta or Active Directory? |
| TR-016 | Does the solution support SSO through SAML or OpenID connect? |
| TR-017 | Does the solution support SSO encryption, and SAML assertion encryption? |
| TR-018 | Does the solution support both IDP and SP initiated authentication? |
| TR-019 | Does the solution provide its own authentication capabilities? |
| TR-020 | If yes, can these be disabled if SSO is enabled? |
| TR-021 | Does the solution provide its own authorization capabilities? |
| TR-022 | Can the authorization and/or authentication approach vary by user? |
| TR-023 | Does the solution allow for authorization to be managed by role? |
| TR-024 | Has your organization ever been subject to a data breech? |
| TR-025 | If yes, please explain the cause, effect, remedy, and any preventative measures taken. |
| TR-026 | Please confirm your tool is compliant with Equal Employment Opportunity obligations. |
| TR-027 | Do you have a SOC1 certification? |
| TR-028 | Do you have a SOC2 certification? |
| TR-029 | If applicable, is your network PCI compliant? |
| TR-030 | Do you perform regular 3rd party penetration/vulnerability scanning? |
| TR-031 | When was the last scan completed? |
| System Event & Audit Logging | |
| TR-032 | Does the system log policy or configuration changes? |
| TR-033 | Are failed login attempts logged? |
| TR-034 | Are user authorization changes logged? |
| TR-035 | Can logs be redirected and/or read by industry standard log parsing software (SUMO)? |
| TR-036 | What transactional/operational and system configuration logging/auditing capabilities are available? |
| TR-037 | What interface logging/auditing capabilities are available? |
| TR-038 | Will the system have the ability to control access to intellectual property? |
| TR-039 | Will the system have the ability to classify sensitive data to differentiate how data will be address or managed? |
| TR-040 | Do you have a disaster recovery plan; including how frequent data is backed up, how often the plan is tested, and how you recover lost data. |
| TR-041 | Describe your support plan, including escalation procedure, response time to an incident and recovery, and how failure is identified by Supplier. |
| Training | |
| TR-042 | Do you provide administrative training? |
| TR-043 | Do you provide online training? |
| TR-044 | Do you provide FAQ / quick-start documents? |
| TR-045 | Do you provide electronic copies of all training materials? Can we distribute training materials for internal consumption? |
| TR-046 | Do you have end-user community forums? |
| System Configuration & Administration | |
| TR-047 | Describe the areas of the solution that can be configured by the system administrator. |
| TR-048 | Do configured attributes apply across the entire application or can they be targeted for specific user groups / organizations? |
| TR-049 | Describe the routine administrative tasks that are recommended to ensure the proper operation of the solution |
| TR-050 | What capabilities does the solution provide for application-level monitoring & diagnostics? |
| TR-051 | Are third party monitoring & diagnostics tools supported for application-level monitoring? |
| TR-052 | What is the solution's uptime? |
| TR-053 | Is the solution deployable to users via SCCM? |
| TR-054 | What are your standard SLAs for your platform? Please attach your Service Level Agreement for our review. |
| TR-055 | How are technical support cases submitted (i.e. an online portal)? |
| TR-057 | Is technical support offered via phone, email and/or chat? |
| TR-058 | Ability to require multi-pronged authentication during user set-ups or user access from new devices. |
| Cyber Review | |
| TR-059 | Please list any Cyber Security Certifications held by your company. |
| TR-060 | Please provide key Point(s) of Contact for Cyber Security questions / Third Party Risk Review |
| TR-061 | Do you have, or are you working towards, a Cybersecurity Maturity Model Certification (CMMC) as prescribed in DFARS 252.204-7021 or DFARS 252.204-7020 |
| Solution Extensibility | |
| TR-062 | Does the solution include a framework for software customization by the customer that is supported and will migrate seamlessly with upgrades? |
| TR-063 | Will you make customizations to your product if requested? If Yes, what is the migration path & expected timeline for a customization to be included in a standard release of the product? |
| TR-064 | What systems is your solution capable of integrating with currently? E.g. Oracle (Financials), ServiceNow |
Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile Technology Profile
Functional Requirements
| Functional Requirements |
| INSTRUCTIONS: Please respond to the questions below using the space provided. |
Using the pre-selected responses in Functionality, Bidder should indicate if each requirement is a current and standard offering (S), future offering (F), an offering requiring customization (C), or not applicable (N/A).
If future (F) or customizable (C), Bidder should use the field on the right to expand on its response.
If an attachment is needed in order to provide a complete response on a question, please reference the name of the attachment in the Comments/Elaboration response field so we can match it up to the correct question when reviewing responses.
| Ref # | Requirement Description | Functionality | |
| (Please select response) | Comments / Elaboration |
If Requirement Functionality will be in a Future Release (F), indicate planned schedule below Response Legend:
S = Standard Functionality included in your product today - "Out of the Box" without Customization C = Requires Customization to meet the Described Requirements F = Future Release - Requirements will be met in a planned upgrade to be released within the near future N/A = Not Available. Not supported currently and not included in any future roadmap for your solution
| Functionality | ||
| FR-01 | Solution should have the ability discover/identify and catalog cloud services in use, both sanctioned and un-sanctioned (shadow IT). | |
| FR-02 | Solution should provide a catalog/database of cloud services and a risk score for each identified cloud service. | S |
| FR-03 | Solution should allow for auditing/reporting on cloud user activity and permissions in cloud services. | C |
| FR-04 | Solution should provide real-time visibility for monitoring cloud data/network traffic in motion. | F |
| FR-05 | Solution should provide the ability to verify and/or enforce authentication requirements, including SSO and MFA, for cloud/SaaS products. | N/A |
| FR-06 | Solution should provide native integration with the majority of approved cloud/SaaS applications within the FNAL IT portfolio (O365, Workday, ServiceNow, etc). | |
| FR-07 | Solution should provide robust alerting and reporting capabilities in the event of a cloud security incident. | |
| FR-08 | Solution should be capable of generating detailed, actionable metrics for data analysis and reporting. | |
| FR-09 | Solution should provide enforceable cloud policy templates, preferably that meet NIST 800-53 rev. 5 baseline requirements for FISMA Low and Moderate systems. | |
| FR-10 | Solution should natively, or with minimal friction, integration with existing suite of cyber security tool (e.g. SIEM, WAF, logging infrastructure, endpoint agents, etc). | |
| FR-11 | Solution should be able to forward logs to external SEIM/log parsing tool (e.g. Google Chronicle, Splunk). | |
| FR-12 | Solution should provide basic DLP functionality for information/data in cloud/SaaS products. | |
| FR-13 | Solution should provide API integration with cloud services, where applicable. | |
| FR-14 | Solution should allow the ability to support transition into full ZTA network framework. | |
| FR-15 | Solution should provide the ability to troubleshoot network/client issues, so as to minimally impact user experience. | |
| FR-16 | Solution should have the ability to support multi-tenant cloud application instances, with end-users from different organizations. | |
| FR-17 | Solution should have the ability to offer role-based access controls (RBAC) to admin portal, with granular control of user dashboard views and reports. | |
| FR-18 | Solution should have the ability to export detailed and executive level reports on cloud security posture. | |
| FR-19 | Solution should have the ability to create custom dashboards for monitoring cloud/SaaS products. | |
| FR-20 | Does your company have anything that has not been mentioned above that differentiates you from the competition? | |
| FR-21 | Are there ways that your company is able to leverage your industry expertise to help customers create best practices. If yes, please give an example. |
Sheet1
| Priority | Description |
| Must Have | A MUST is critical to the current project in order for it to be a success. |
| Should Have | A SHOULD is important but not necessary for delivery in the current project. |
| Could Have | A COULD is desirable but not necessary, and could improve user experience or customer satisfaction. |
| Won't Have | A WONT has been agreed by stakeholders as the least-critical, lowest-payback items, or not appropriate at that time. As a result, WON'T requirements are not planned into the schedule for the project. |
| S | |
| C | |
| F | |
| N/A |
| Yes | |
| No | DO NOT MODIFY INFORMATION ON THIS TAB. MODIFICATIONS WILL AFFECT THE OTHER TABS |
| Unknown |
File details come from the government source that posted it. Updated .