RFP-C002422 Cyber Threat Intelligence Platform.pdf

RFP-C002422 Cyber Threat Intelligence Platform Page 1

Yes

Request for Proposals

**Cyber Threat Intelligence Platform**

RFP-C002422

Contract Period: 3-Years with two (2) one-year optional renewals

BID DUE DATE: August 27, 2026 @ 3:30 PM

Issue Date: August 4, 2026

Questions Due: August 11, 2026

Designated Contacts

PRIMARY CONTACT ALTERNATE CONTACT

Shannon Diederich Contract Management Specialist 1

Sharon Pailley Contract Management Specialist 2

Telephone: (518) 485-0933 Telephone: (518) 485-7545

Address: New York State Police 1220 Washington Ave., Bldg. 22

Albany, New York 12226 Email: Contracts@troopers.ny.gov

RFP-C002422 Cyber Threat Intelligence Platform Page 2

NON-BID RESPONSE FORM

A required activity of the solicitation process is the compiling of a Bid Tabulation. Ideally, this tabulation should incorporate not only those proposals submitted but also feedback from vendors receiving the solicitation document to determine why proposals were not submitted. Your cooperation in completing this form is requested should your company/agency decide not to respond to the below identified solicitation. Please forward your response to:

Shannon Diederich, CMS1 New York State Police 1220 Washington Ave., Bldg. 22

Company Name:

Address:

City, State, Zip: Telephone:

Solicitation Title: RFP-C002422 ☐ My business did not bid on the above identified solicitation but please leave our business on your bidder’s list.

☐ My business did not bid on the above identified solicitation, and we wish to be excluded from your bidder’s list for future solicitation considerations.

REASONS FOR NOT SUBMITTING A BID (Please check all that apply.)

☐ Work or service requested not performed by the business. Please indicate your organization’s type of work or service performed:

☐ Bid request received too late. Insufficient time to plan, estimate and submit a bid.

☐ Unable to meet specifications/other considerations in this proposal. Please explain:

☐ Specifications in the solicitation were unclear. Please explain:

☐ Unable to meet insurance requirements.

☐ Reluctant to contract with the State because of the many standard requirements.

☐ Previous unfavorable experience with state contracts/work. Please explain:

☐ Other (specify):

Print Name Title

Signature Date

RFP-C002422 Cyber Threat Intelligence Platform Page 3

Table of Contents

NON-BID RESPONSE FORM

1. Introduction

1.1 Overview

1.2 Designated Contacts

1.3 Key Events

1.4 RFP Questions and Clarifications

1.5 Bidders’ Conference

1.6 Bid Addenda

1.7 Glossary of Terms

1.8 Confidential/Proprietary Information

2. Bid Submission

2.1 Instructions for Bid Submission

2.2 Bid Opening

2.3 Bid Evaluation

3. Administrative Information

3.1 Scope of Work

3.2 Method of Award

3.3 Price

3.4 Estimated Quantities Contracts

3.5 Technical and Management Proposal (165 Points Total)

3.6 Cost Proposal

3.7 Software Demonstration (50 points):

3.8 Proposal Evaluation

3.9 Term of Contract

3.10 Method of Payment

3.11 Electronic Payment

3.12 Dispute Resolution

3.13 Contractor Responsibilities

3.14 Inspection of Books

4. Requirements

4.1 Qualifications of Bidder

4.2 Mandatory Requirements

4.3 Mandatory Software Demonstration Requirements

4.4 Technical Requirements

4.5 Delivery

4.6 Warranty

5. Contract Clauses and Requirements

5.1 Appendix A

5.2 Appendix B

5.3 Appendix C

RFP-C002422 Cyber Threat Intelligence Platform Page 4

5.4 Order of Precedence

5.5 SAM.gov Requirements

5.6 National Institute of Standards and Technology (NIST)

5.7 Gender-Based Violence and the Workplace Requirement

5.8 Procurement Lobbying Requirement

5.9 Consultant Disclosure

5.10 Contractor Insurance Requirements

5.11 Tax and Finance Requirements

5.12 Participation by Minority Group Members and Women: Requirements and Procedures

5.13 Participation by Service-Disabled Veterans: Requirements and Procedures

5.14 General Requirements

5.15 Procurement Rights

5.16 Debriefings

5.17 Termination

5.18 New York State Vendor File Registration

5.19 New York State Vendor Responsibility

5.20 Ethics Compliance

5.21 Sexual Harassment Prevention

5.22 Indemnification

5.23 Force Majeure

5.24 Appendices and Attachments

6. REQUIRED FORMS/ CERTIFICATIONS – RETURN WITH BID

RFP-C002422 Cyber Threat Intelligence Platform Page 5

1. Introduction

1.1 Overview

The New York State Police (NYSP) is accepting bids for a Cyber Threat Intelligence Platform. As a result of this Request for Proposals (RFP), NYSP intends to enter into a three-year contract with two (2) one-year optional renewals with the bidder whose proposal is determined to represent the best overall value for NYSP, based on a technical evaluation, software demonstration evaluation, and the total cost of ownership over the life of the contract.

New York State Contract Reporter Bidders must register with the New York State Contract Reporter (“NYSCR”) at https://www.nyscr.ny.gov in order to receive notifications about this Solicitation. Navigate to the “Find Contracts” page, by clicking on “Find Bids” or “Find Contracts”, to register for your free account. In order to receive e-mail notifications regarding updates to the content or status of a particular ad, you must choose the option “Notify me if this ad updates,” located in the top right-hand corner of the ad.

Answers to all questions of a substantive nature will be posted in the form of a question-and-answer document and released through the NYSCR. Any updates to Solicitation documents will also be posted and released through the NYSCR. If you do not opt-in to receive notification updates regarding a particular ad, you will not receive e-mail notifications regarding updates, including e-mail notifications regarding the posting of the question-and-answer document and updates to Solicitation documents. Be advised that submission of responses to the Solicitation that do not reflect and take into account updated information may result in your Bid being deemed non-responsive to the Solicitation.

1.2 Designated Contacts

In compliance with the Procurement Lobbying Law, Shannon Diederich, Contract Management Specialist 1 (CMS1) has been designated as the Primary Contact for this procurement and may be reached by email for inquiries regarding this solicitation. If the Primary designated contact is not available, the Alternate Contact is also listed below.:

PRIMARY CONTACT ALTERNATE CONTACT

Shannon Diederich, CMS1 Sharon Pailley, CMS2 1220 Washington Ave., Bldg. 22 1220 Washington Ave., Bldg. 22 Albany, New York 12226 Albany, New York 12226

Phone No.: (518) 485-0933 Phone No.: (518) 485-7545 E-Mail: Contracts@troopers.ny.gov E-Mail: Contracts@troopers.ny.gov

Communications regarding this procurement may only occur with the primary and alternate contacts listed above until the resulting contract is fully executed.

1.3 Key Events

The Table below outlines the schedule for important action dates of this RFP-C002422.

Event Date / Time

NYSP Issues Request for Proposal (RFP) August 4, 2026

Deadline for Submission of Bidder Questions August 11, 2026

NYSP Issues Responses to Written Questions (estimated) August 20, 2026

Bid Due Date/ Bid Opening Date August 27, 2026 @ 3:30 PM EST

Mandatory Software Demonstrations Dates TBD

Contract Start Date (Estimated-Subject to OSC Approval) October 1, 2026

1.4 RFP Questions and Clarifications

All questions and/or requests for clarification regarding this RFP are only accepted via e-mail and should be sent to Shannon Diederich at Contracts@troopers.ny.gov. Deadline for submission of questions will be as indicated in §1.3 Key Events. In the subject line please reference “RFP-C002422”. A Bidder is strongly encouraged to submit questions as

RFP-C002422 Cyber Threat Intelligence Platform Page 6 soon as possible. Questions submitted after the deadline indicated may not be answered. Official answers to all questions of a substantive nature will be provided in the form of a question and answer (Q&A) document available to all prospective Bidders via posting to the New York State Contract Reporter website https://www.nyscr.ny.gov/.

1.5 Bidders’ Conference

No Bidder’s Conference will be held for this RFP. Prospective bidders may submit questions via email to Contracts@troopers.ny.gov by the date and time indicated in §1.3 Key Events.

1.6 Bid Addenda

Any addendum issued prior to the Bid due date must be acknowledged by signature, dated and be submitted on or before the Bid due date. In awarding a contract any addenda will become part thereof.

Any verbal information obtained from, or statements made by, representatives of the NYSP at the time of examination of the contract documents shall not be construed in any way amending the contract documents. Only such corrections or addenda as issued, in writing, to all Bidders shall become part of the contract.

1.7 Glossary of Terms

Industry Terms “Advanced Persistent Threat (APT)” shall mean an adversary with sophisticated levels of expertise and significant resources, allowing it to use multiple attack vectors (i.e. cyber, physical, and deception), to achieve its objectives repeatedly over an extended period of time.

“Anomaly Detection” shall mean the automated identification of data points or behaviors that do not match normal or expected patterns.

“Application Programming Interface (API)” shall mean a connection between computers or between computer programs.

“Clustering” shall mean automatically grouping similar detections or events based on shared characteristics.

“Comma-Separated Values (CSV)” shall mean plain text data format for storing tabular data.

“Comprehensive” shall mean complete, thorough, significantly more than the minimum, including most or all sources and reports.

“Correlation” shall mean linking related data from different sources based on time, location, or attributes.

“Custom Dashboard” shall mean a user-configurable visual display that shows selected data, charts, or maps relevant to a mission or role.

“Data Catalog” shall mean an indexed inventory of all available datasets, including metadata describing their source, time, and content.

“Data Deduplication” shall mean the process of identifying and removing duplicate records to avoid redundant or misleading data.

“Data Ingestion” shall mean the process of collecting and importing data into the platform from sensors or external systems.

“Data Lineage” shall mean a record showing where data originated, how it was processed, and how it changed over time.

“Encryption at Rest” shall mean protection of stored data so it cannot be read without proper authorization.

“Encryption in Transit” shall mean protection of data while it is being transmitted between systems or users.

“Indicators of Compromise (IOCs)” shall mean evidence that someone may have breached/attacked a victim’s network or device.

“Machine Learning” shall mean algorithms that learn from historical data to identify patterns, trends, or predictions.

“Metadata” shall mean descriptive information about data, such as source, timestamp, sensor type, or location.

“Message Queuing Telemetry Transport (MQTT)” shall mean a standards-based messaging protocol, or set of rules, used for machine-to-machine communication.

“Near real-time” shall mean no more than 5 minutes.

“Schema Enforcement” shall mean rules that ensure data follows required formats and structures.

“System Logging Protocol (Syslog)” shall mean a standard for computer data logging that allows software applications and systems to send log messages to a centralized log management system or log file.

“Unified Data Environment” shall mean a single system where all authorized users’ access, analyze, and visualize shared data.

“Validation” shall mean automated checks that ensure incoming data is complete, accurate, and not corrupted.

“Versioning” shall mean maintaining historical versions of datasets to track changes over time.

RFP-C002422 Cyber Threat Intelligence Platform Page 7

“Visualization” shall mean graphical representations of data such as charts, maps, timelines, or dashboards.

“Extensible Markup Language (XML)” shall mean a markup language and file format for storing, transporting, and sharing data in a structured, human-readable, and machine-readable format.

General/ NYSP Terms “A/R/O” shall mean, after receipt of order.

“Issuing Office” shall mean the New York State Police.

“Contractor” shall mean a successful company awarded a contract pursuant to this RFP.

“F.O.B. Destination” As Defined in U.C.C. §2-319, “free on board (F.O.B.) destination” shall mean there will be no charge for delivery to the agency’s specific location and that the title is conveyed from the vendor to the agency at the destination of the shipment. The vendor owns the goods during transit and will file any damage claims.

“Request for Proposals” or “RFP” shall mean this document. See also, “solicitation”.

“§” shall mean section.

“Solicitation” shall mean this RFP document.

“State” (or the State) shall mean The People of the State of New York, which shall also mean the New York State Police.

“Superintendent” shall mean the Superintendent of the New York State Police or duly authorized representative.

“Offeror” or “Bidder” shall mean any person, partnership, firm, corporation or other authorized entity submitting a bid to the State pursuant to this RFP.

“Product” shall mean the Cyber Threat Intelligence Platform as stated in §4. Requirements, and to be procured by the contract pursuant to this solicitation.

“Shall” denotes the imperative in a contract clause or specification. Means required – being determinative/ mandatory, as well as imperative.

“Must” denotes the imperative in a contract clause or specification. Means required- being determinative/ mandatory, as well as imperative. Also see “shall”.

1.8 Confidential/Proprietary Information

During the evaluation process, the content of each Bid will be held in confidence and details of any Bid will not be revealed (except as may be required under the Freedom of Information Law or other State law). Bidder shall specifically identify those portions of their bid deemed to be confidential, proprietary information or trade secrets and provide any justifications why such material, upon request, should not be disclosed by the NYSP. Marking the Bid as “confidential” or “proprietary” on its face or in the document header or footer shall not be considered by NYSP to be sufficient to withhold disclosure.

Bidder must submit with their Bid the form “Request for Exemption from Disclosure Pursuant to the Freedom of Information Law,” located in §6. Required Forms/ Certifications of this solicitation in order to request exemption of portions of their Bid from Freedom of Information Law or other State law disclosure.

~Remainder of Page Intentionally Left Blank~

RFP-C002422 Cyber Threat Intelligence Platform Page 8

2. Bid Submission

2.1 Instructions for Bid Submission

Only bids from Bidders who furnish all required information and meet the mandatory requirements will be considered.

Submit all required bid documents to the NYSP at the following address:

New York State Police Attn: Shannon Diederich RFP-C002422

E-Mail or Fax Bid Submissions are NOT Acceptable and will NOT be Considered The State of New York will not be held liable for any cost incurred by the Bidder for work performed in the preparation and production of a bid or for any work performed prior to the formal execution of a contract. Bids must be received in the above office on or before 3:30 PM ET on the date indicated in §1.3 Key Events. The received time of bids will be determined by NYSP at the clock at the above noted location. Bidders assume all risks for timely, properly submitted deliveries.

Late Bids May be Rejected Any Bid received at the designated location after the established time will be considered a Late Bid. A Late Bid may be rejected and disqualified from award. Notwithstanding the foregoing, a Late Bid may be accepted at the Superintendent’s sole discretion where (i) no timely Bids meeting the requirements of the Solicitation are received, or (ii) the Bidder has demonstrated to the satisfaction of the Superintendent that the Late Bid was caused solely by factors outside the control of the Bidder. However, in no event will the Superintendent be under any obligation to accept a Late Bid.

Firm Offer Bids must remain an effective offer, firm and irrevocable, for at least 120 calendar days from the due date, unless the time for awarding the contract is extended by mutual consent of NYSP and the Bidder. A bid shall continue to remain an effective offer, firm and irrevocable, subsequent to such 120 calendar-day period until either tentative award of the contract(s) by issuing Office is made or withdrawal of the bid in writing by Bidder.

Ownership of RFP and Bids This RFP remains the property of the State at all times, and all responses to this solicitation, once delivered, become the property of the State.

Packaging of RFP Response To ensure all bids are received and to guard against premature opening, sealed bids shall be submitted, plainly marked with the following information on the outside of the package(s).

Bidder’s complete name and address

“BID ENCLOSED”

Solicitation Number: RFP-C002422 Bid Due Date and Time: August 27, 2026 @ 3:30 PM EST (see §1.3 Key Events) Bid for: Cyber Threat Intelligence Platform

Within each package, bidder must include the following:

A cover letter containing the name, position, address, and telephone number of the person(s) with the authority to represent the contractor.

One (1) original Technical Proposal in a sealed envelope labeled “Technical Proposal”.

One (1) original Cost Proposal, including one (1) complete set of originals of all forms as indicated in §6. Required

Forms and Certifications, in a separate sealed envelope labeled “Cost Proposal”.

Spiral bound proposals will NOT be accepted.

RFP-C002422 Cyber Threat Intelligence Platform Page 9

Please ensure the following:

a) Prepare your bids on the forms provided.

b) Bids and other forms must be signed, in indelible ink, by an official of your firm authorized to sign contracts and bind the firm. Pencil will not be accepted.

c) Print the name of your company on each page of the bid.

d) Bidders must respond to each, and every specification stated in the RFP.

Important Building Access Procedures for Hand-Delivered Bids Building access procedures are in effect at NYSP building. Photo identification is required. All visitors must register for building access for delivering bids. When hand-delivering a bid, Bidders are encouraged to give notice at least two (2) hours prior to arrival at NYSP with a hand delivered bid by contacting the NYSP Primary Contact at 518-485-0933 or email Contracts@troopers.ny.gov. Bidders are encouraged to arrive thirty (30) minutes prior to the bid submission deadline (see §1.3 Key Events) to minimize any delays in timely receipt of bid.

2.2 Bid Opening

Bid opening for RFP-C002422 Cyber Threat Intelligence Platform will be held at NYS Police 1220 Washington Ave., Bldg.

22, Albany, NY 12226, on the date and time indicated in §1.3 Key Events. Attendance by the Bidder at the Bid opening is not a requirement of this RFP.

Important Building Access Procedures for Bid Opening Attendance Building access procedures are in effect at NYSP building. Photo identification is required. Due to limited space, only one

(1) company representative will be allowed to attend the bid opening. Bidder must pre-register with the NYSP Primary Contact by email at Contracts@troopers.ny.gov, at least 24 hours prior to Bid Opening Date as specified in §1.3 Key Events. It is recommended that the attendee arrive thirty (30) minutes prior to the scheduled time of the bid opening to sign in at NYSP reception desk. Once signed in, pre-registered visitors are to report to the reception area. Bid opening will begin promptly at 3:30 p.m. EST. Attendees arriving after the bid opening begins will be precluded from entering the meeting room.

Attendees will be required to sign in at the bid opening and provide basic company and contact information. This information will be used to verify attendance and submitted to the Office of the State Comptroller (OSC) as required activity of the RFP process. Therefore, it is imperative that the provided information be legible and accurate.

2.3 Bid Evaluation

NYSP reserves the right to accept or reject any and all Bids, or separable portions of offers, and waive technicalities, irregularities, and omissions if NYSP determines the best interests of the State will be served. NYSP may accept or reject illegible, incomplete, or vague Bids and NYSP decision shall be final.

RFP-C002422 Cyber Threat Intelligence Platform Page 10

3. Administrative Information

3.1 Scope of Work

The NYSP is seeking an appropriately qualified vendor to provide a cyber threat intelligence platform for the New York State Police. Please refer to this RFP-C002422, §4. Requirements in its entirety.

3.2 Method of Award

To be eligible for contract award, a respondent must submit a complete response to the RFP. The NYSP will evaluate proposals on the basis of compliance with the Mandatory Criteria. Proposals meeting mandatory requirements listed in §4.

Requirements, in its entirety will be rated by two Evaluation Panels – one for the Cost Proposal and one for the Technical Proposal and Software Demonstrations.

3.3 Price

Bid Price per unit shall be F.O.B destination and include all services required to provide the items as specified in this RFP, including licenses, insurance, administrative, customs, duties, travel, shipping charges and ancillary costs. Bid price includes any and all costs associated with providing the Product.

3.4 Estimated Quantities Contracts

The quantities or dollar values listed are estimated only. The Contract resulting from this RFP shall be an estimated quantities Contract. No specific quantities or volumes are represented or guaranteed. Actual payment to the vendor will be based on the price per unit for the actual license type. NYSP is open to considering user license and site license options.

NYSP is anticipating approximately up to 15 users for this software.

3.5 Technical and Management Proposal (165 Points Total)

The Bidders Technical Proposal shall not contain any cost information.

The Technical Proposal must include a completed Mandatory Technical Proposal Checklist (Attachment 2) and must include a description of the assessment process and the manner in which the bidder intends to provide the services. The following must be included:

1. Company Profile / Experience and References (25 points):

a. Cover letter including the name, position, address, and telephone number of the person(s) with the authority to represent the Contractor.

b. A brief history of the bidder as it pertains to cyber threat intelligence platform services including the number of years the bidder has been in business providing the proposed software

i. Proof that the bidder has at least five (5) years of demonstrated experience in providing a cyber threat intelligence platform solution and support similar in size and scope as described in this

RFP.

c. A minimum of three (3) references. References shall be commercial or governmental accounts and should include the following:

i. Company name, address, contact person, telephone number, email address, and number of years the bidder has serviced the referenced account.

2. Bidder’s Work Product Proposal (140 points):

a. Describe how the proposed system architecture meets the mandatory requirements as outlined in

Section 4.2.1 Requirements: System Architecture & Core Capabilities

b. Describe how the proposed system architecture meets the mandatory requirements as outlined in Section 4.2.2 Requirements: Data Management & Cataloging

c. Describe how the proposed system architecture meets the mandatory requirements as outlined in

Section 4.2.3 Requirements: Data Storage & Security

RFP-C002422 Cyber Threat Intelligence Platform Page 11

i. The bidder shall provide a list of pre-established integrations with commonly used partner organizations

d. Describe how the proposed system architecture meets the mandatory requirements as outlined in

Section 4.2.4 Requirements: Data Ingestion, Exportation, & Integration

e. Describe how the proposed system architecture meets the mandatory requirements as outlined in Section 4.2.5 Requirements: Analytics, Machine Learning & Visualization

i. The bidder should disclose the bidder’s intended AI and machine-learning capabilities.

f. Describe how the proposed system architecture meets the mandatory requirements as outlined in Section 4.2.6 Requirements: User Experience & Interface

i. The bidder should include an explanation of how they incorporate end user feedback and requests into updating the platform to improve the user experience and update collection sources.

g. Describe how the proposed system architecture meets the mandatory requirements as outlined in

Section 4.2.7 Requirements: Data Governance & Integrity

h. Describe how the proposed system architecture meets the mandatory requirements as outlined in Section 4.2.8 Requirements: Extensibility & Application Development

i. Describe how the proposed system architecture meets the mandatory requirements as outlined in Section 4.2.9 Requirements: Training, Support & Licensing

3.6 Cost Proposal

The Bidder’s Cost Proposal shall not contain any information needed to evaluate the Technical Proposal.

The Cost Proposal package must include one (1) complete set of originals of all forms as indicated in §6. Required Forms and Certifications, and a quote based on Bidder’s own pricing model. Please refer to Attachment 1 – Cost Proposal in its entirety.

Any and all expenses not accounted for on the quote submitted with your proposal will not be entertained.

Incurred Costs All costs incurred in the preparation, submission, and/or presentation of a Proposal responding to this RFP including, but not limited to, the reproduction and delivery expenses, shall be the sole responsibility of the respondent and shall not be reimbursed by the State.

Amendments to Proposals Amendments and/or withdrawals of proposals shall be allowed only if the amendment is received prior to the opening date and time identified in §1.3 Key Events. No amendment or corrections shall be accepted after the proposal opening date and time.

3.7 Software Demonstration (50 points):

Bidders intending to submit a bid should be prepared to provide a mandatory software demonstration at the bidder’s expense. After the cost and technical scores have been calculated, bidders will be required to provide a demonstration of their software either in-person or via Microsoft Teams (or other online meeting forum). Software demonstrations will be limited to 1 hour in duration. Please refer to §4.3 Mandatory Software Demonstration Requirements in its entirety.

3.8 Proposal Evaluation

NYSP reserves the right to accept or reject any and all proposals, or separable portions of offers, and waive technicalities, irregularities, and omissions if NYSP determines the best interests of the State will be served. NYSP may accept or reject illegible, incomplete, or vague proposals and NYSP’s decision shall be final.

Weights will be applied to categories as follows for scoring purposes:

RFP-C002422 Cyber Threat Intelligence Platform Page 12

Technical Evaluation Relative Weight -Company Profile / Experience and References 10% -Bidder’s Work Product Proposal 25% Cost Assessment 30% Software Demonstration 35%

Evaluation of proposals will be conducted in two parts: Technical Evaluation and Cost Assessment. The NYSPs technical Evaluation committee will review the technical portion of each proposal and compute the technical score. All of the technical scores for each bidder will be added together and averaged to arrive at a final technical score. Technical Evaluation will comprise 35% of the total score.

A Cost Assessment score will be computed separately by the NYSP’s Cost Evaluation Team. The cost evaluation will comprise 30% of the total score. Cost scoring will be based upon a pre-determined cost formula with the lowest cost proposal receiving 30% and all other proposals receiving a percentage of 30% based on their cost in relation to the lowest bidder.

The software demonstrations will be conducted after the cost and technical scores have been calculated and will be evaluated by the technical evaluation team. The software demonstration will comprise 35% of the total score.

The NYSP, at its sole discretion, may limit participation in vendor software demonstrations to those vendors receiving a score of at least 75 for the weighted combined available points for technical and cost proposals. The NYSP reserves the right to forego vendor software demonstrations and select vendor(s) based on the written proposals submitted.

The final technical and cost scores for each proposal will be added together resulting in a total score.

Evaluators of the Technical Evaluation Team may then meet to provide clarity or clear any questions an evaluator has about a particular section of a proposal. Following any such discussion, evaluators may independently revise their original score in any section and will note changes on the evaluation sheet. Once completed, final Technical Evaluation scores will be recalculated, averaged, and applied to the final Cost Assessment score to arrive at final scores.

In case of a tie, where overall scores are the same, the contract will be awarded to the bidder with the lowest cost.

3.9 Term of Contract

The Bidder must be willing to enter into a three-year contract with two (2) one-year optional renewals. Any negotiated contract must conform to the laws of New York State and will be subject to approval by the Office of the State Comptroller.

The contract will not be considered fully executed until formal approval has been granted by the Office of the State Comptroller.

The contract start date is estimated to be October 1, 2026.

3.10 Method of Payment

For the purposes of this contract an invoice must be used. Each invoice must have a unique invoice number and contain the Contractor’s New York Contract ID number, PO number and PO line description and an itemization of work completed/ product delivered. Such itemization must be in accordance with the bid form. Invoices for payment shall be submitted upon completed delivery of each order on a company invoice for services satisfactorily completed.

Invoices shall be submitted to the OGS Business Services Center (BSC) Accounts Payable Unit at Accountspayable@ogs.ny.gov. Invoices will be processed in accordance with established procedures of the Office of General Services and the Office of the State Comptroller (OSC), and payments will be subject to the prompt payment provisions of Article XI-A of the New York State Finance Law. Invoices without the required information will be returned to Contractor to be completed as required.

Mere acknowledgement by NYSP personnel of the delivery or receipt of goods (e.g., signed bill of lading) shall not be deemed or construed as acceptance of the Products received. Any delivery of Product that does not conform with specifications of the RFP or Contract terms and conditions, may be rejected, or accepted on an adjusted price basis at the sole discretion of the Superintendent of the NYSP.

RFP-C002422 Cyber Threat Intelligence Platform Page 13

3.11 Electronic Payment

Contractor shall provide complete and accurate billing invoices in order to receive payment. Billing invoices submitted must contain all information and supporting documentation required by the contract, the agency, and the State Comptroller.

Payment for invoices submitted by the contractor shall only be rendered electronically. Such electronic payment shall be made in accordance with ordinary State procedures and practices. The Contractor shall comply with the State Comptroller’s procedures to authorize electronic payments. Information is available at the following website:

https://www.osc.state.ny.us/state-vendors, by e-mail at ePayments@osc.state.ny.us, or by phone at 518-474-4032.

Contractor acknowledges that it will not receive payment on any invoices submitted under this Contract if it does not comply with the State Comptroller’s electronic payment procedures. Please note that in conjunction with New York State’s implementation of a new Statewide financial system, the Office of the State Comptroller requires all vendors doing business with New York State agencies to complete a substitute W-9 form. Vendors registering for electronic payment can complete the W-9 form when they register. Vendors already registered for electronic payment are requested to go to the above website and complete the Substitute W-9 form and submit following the instructions provided.

3.12 Dispute Resolution

It is the policy of the NYSP to provide vendors with an opportunity to administratively resolve disputes, complaints or inquiries related to bid solicitations, contract awards, and contract administration. NYSP encourages vendors to seek resolution of disputes informally, through consultation with the NYSP staff, prior to commencing a formal dispute process.

All such matters will be accorded impartial and timely consideration.

3.13 Contractor Responsibilities

The Contractor shall be solely responsible for all compliance with terms and conditions in this RFP or any resulting Contract.

The Contractor may not engage a subcontractor or dealer, distributor, reseller, or any other party to carry out any part of this contract without the prior written consent of NYSP. The Contractor accepts full responsibility for the actions of any employee or subcontractor who carries out any of the provisions of any Contract resulting from this RFP.

3.14 Inspection of Books

It is expressly understood and agreed that NYSP and the New York State Comptroller shall have the right to inspect and audit the Contractor’s records covered under this Agreement, in accordance with his statutory responsibility to examine the books and accounts of every Agency. The New York State Comptroller requires, and the Contractor agrees to, the retention of all material that is pertinent to an audit of the operations under any contract resulting from this RFP for a full six-year period.

RFP-C002422 Cyber Threat Intelligence Platform Page 14

4. Requirements

4.1 Qualifications of Bidder

Bids will be accepted only from established manufacturers or their authorized dealers. A completed MANUFACTURER'S CERTIFICATE must be completed with bid submissions.

The NYSP will require the Bidder to provide documentation showing they have been active in selling the products offered for a minimum of five (5) years.

The NYSP reserves the right to investigate or make any inquiry into the capabilities of any bidder to properly perform under any resultant contract.

The NYSP reserves the right to complete a thorough security analysis, including how the use of AI will be integrated into the system, to ensure vendors have proper security and encryption measures in place. Final determination based on the results of the security analysis shall be at the sole discretion of the NYSP.

Cloud service providers, if applicable, must be either Microsoft Azure or AWS (or equivalent) with data residency and transmission residing within United States-based facilities under U.S. jurisdiction.

Note: Microsoft Azure for Government or AWS GovCloud (US) are preferred.

4.2 Mandatory Requirements

The following specifications define the minimum required operational capabilities for the cyber threat intelligence platform.

Equivalent or superior configurations that meet or exceed these capabilities will be considered.

1. System Architecture & Core Capabilities

1.1. The system shall function as a comprehensive, near real-time, cyber threat intelligence platform capable of indexing, organizing, and sourcing data from open-sources, the dark web, and technical feeds.

1.2. The system shall provide a unified data environment allowing authorized users to manage, query, and visualize all collected data through a single web-based interface.

1.3. The system shall provide cyber threat intelligence reports to inform on threats to all 16 critical infrastructure sectors listed in Presidential Policy Directive 21 (PPD-21): Critical Infrastructure Security and Resilience, which is incorporated by reference.

1.4. The system shall provide actionable cyber threat intelligence reports on cyber threat actors, to include advanced persistent threats (APTs), detail the use of their tactics, techniques, and procedures (TTPs), including indicators of compromise (IOCs).

2. Data Management & Cataloging

2.1. The platform shall include comprehensive metadata management and data cataloging, ensuring all records are indexed and searchable by time, source, sensor type, and geographic reference.

2.2. The system shall perform data normalization, deduplication, and schema enforcement, allowing consistent data structures across varying sources.

2.3. The platform shall support data lineage tracking and versioning to maintain full traceability from raw input to processed analytics output. This should also include sourcing information on where each datapoint specifically comes from.

3. Data Storage & Security

3.1. All stored data shall be encrypted at rest and in transit, employing secure authentication and authorization mechanisms for user and API access.

RFP-C002422 Cyber Threat Intelligence Platform Page 15

3.2. All data shall reside within United State-based facilities under U.S. jurisdiction.

4. Data Ingestion & Integration

4.1. The platform shall include real-time data ingestion and exportation tools provided, including supported file formats (e.g. JSON, CSV, XML, syslog, MQTT, and API).

4.2. The system shall ingest and continuously update large-scale open-source, technical, and dark web intelligence from numerous diverse sources in near real-time.

4.3. The platform shall have documented integrations or APIs capable of exchanging information with commonly used cyber threat intelligence platforms and standards.

5. Analytics, Machine Learning & Visualization

5.1. The system shall provide built-in analytics and visualization capabilities, allowing users to perform both real-time and historical analysis of data.

5.2. The platform shall enable creation of custom dashboards, reports and visualizations for operational monitoring, trend analysis, and incident review, configurable by role or mission requirements.

5.3. The system shall have query and correlation capabilities across spatial, temporal, and attribute-based dimensions.

5.4. The platform shall have machine-learning features to include anomaly detection, predictive analytics, and automated classification or clustering.

5.5. The analytics engine shall support advanced analysis and predictive techniques that identify AI-driven insights or predictive modeling are used to identify emerging patterns or risks based on historical behavior.

5.6. The platform shall have clear labeling, as being created by AI when information is created from generative AI models.

6. User Experience & Interface

6.1. The platform shall have dashboards or saved views that shall support secure sharing with multiple authorized organizations without technical limitations that impede operational collaboration.

6.2 The platform shall have the ability to incorporate end user feedback and requests.

7. Data Governance & Integrity

7.1. The platform shall have automated validation and consistency checks performed during data ingestion.

7.2. All system interactions shall be audit-logged, including data changes, access events, and administrative actions.

7.3. The system shall support data classification and tagging to denote sensitivity levels, operational relevance, or partner ownership.

7.4. The platform shall restrict queries or work conducted by the end user to ensure they are not observable by others from outside the end user’s own organization.

8. Extensibility & Application Development

8.1. The solution shall provide native analytics, supporting ad-hoc querying and visualization capabilities without requiring separate analytical software for core functionality.

9. Training, Support & Licensing

9.1. The vendor shall provide administrator and analyst training, with an option for live, virtual, or in-person training.

RFP-C002422 Cyber Threat Intelligence Platform Page 16

9.2. The vendor shall deliver 24/7 technical support, updates, and maintenance for the duration of the contract.

Technical support must be provided by a live person, not an AI Agent however, support may be provided virtually/remotely.

Updates shall be managed and implemented by the vendor as soon as feasible. Vendor service-level agreement shall specify their process and timeline for updates.

9.3. The vendor shall provide comprehensive documentation, including data-model references, API guides, lifecycle-management best practices, and security-hardening standards.

4.3 Mandatory Software Demonstration Requirements

Bidders intending to submit a bid must provide a mandatory demonstration of their proposed software at the bidder’s expense. After the cost and technical proposal scores have been calculated, bidders will be contacted to schedule the mandatory demonstration.

To ensure fairness in the evaluation process, all bidders providing the software demonstration must show their software’s ability to perform the below minimum required capabilities during their demonstration.

1. Demonstrate how the system functions as a comprehensive, near real-time, cyber threat intelligence (CTI) platform capable of indexing, organizing, and sourcing data form open-sources, the dark web, and technical feeds.

1.1 Must include examples of how the system provides usable CTI on critical infrastructure.

1.2 Must include examples of CTI reports, from within the past year, on cyber threat actors targeting New York, the related indicators of compromise (IOCs), and detail the use of their tactics, techniques, and procedures (TTPs).

1.3 Must show how the system is searchable by different data types, such as time, source, and sensor type, and geographic reference.

1.4 Must show the system’s export features and associated file types.

1.5 Must show the system’s analytics and visualization capabilities, to include creating custom views and dashboards.

1.6 Must show how the system utilizes AI / machine learning to conduct analysis and show how AI-derived data is clearly labeled.

2. Provide detailed explanation of the following items within demonstration:

2.1 How data is secured, whether at rest or in transit.

2.2 Where the data is stored.

2.3 Where the data and intelligence that populates the system comes from.

2.4 How the vendor will incorporate customer feedback and requests into updating the platform to either improve the user experience or update collection sources.

4.4 Technical Requirements

NYSP will only procure end point devices that shall be consistent with any relevant standards, guidelines or guidance developed as part of the National Institute of Standards and Technology (NIST) Cyber Security Framework 2.0.

Compliance Vendor’s technology must comply with each of the following:

1. NYS Information Technology Services Information Security Policy and Standards

RFP-C002422 Cyber Threat Intelligence Platform Page 17

2. Federal Bureau of Investigation Criminal Justice Information Services (CJIS) Security Policy, which has been adopted as the agency’s general information security policy.

Artificial Intelligence (AI) Systems AI Systems must comply with each of the following:

1. NYS-P03-002: Information Security Policy

2. NYS-P14-001: Acceptable Use of Information Technology Resources

3. NYS-P24-001: Acceptable Use of Artificial Intelligence Technologies

4. ITS-P19-002: ITS Cloud Computing Policy

5. All associated standards found at https://its.ny.gov/policies

6. Any additional controls required by applicable Federal or State law, rule, or regulation (e.g., IRS Publication 1075) must also be incorporated. AI systems must be developed and reviewed in alignment with NYS-S13-001: Secure Systems Development Lifecycle

7. Product may not use any form of artificial intelligence (AI) outside of the approved initial proposed usage, either now or in the future, without written consent from the New York State Police Chief Information Security Office and/ or Counsel. AI-specific terms should be explicitly defined and presented separately from the general terms and conditions to ensure clarity and transparency.

8. Provide NYSP with written notice at least 90 days prior to the implementation or use of any AI technology in Vendor's software, hardware, or in any dealings or communication with the State, the State’s employees, contractors or consultants, public users, members of the public, or data-subjects. Such notice shall include a detailed description of the AI technology to be used, its intended purpose, its connections with the State, when the AI will be deployed within a tool, whether that AI is open-source, and how the AI will be implemented. NYSP reserves the right to request additional documentation related to AI prior to or while the AI is in use.

9. For AI tools not integral to the system, AI tools should be disabled by default. Any AI usage must be approved, in writing, by NYSP. After analysis, should NYSP deem the AI unacceptable and AI functionality cannot be disabled, NYSP reserves the right to terminate contract at no cost.

The NYSP reserves the right to conduct a full Information Security-validated assessment during the evaluation process, including investigating Artificial Intelligence capabilities and security processes. Written agreement of various policies may be required.

4.5 Delivery

Schedule: Delivery as applicable to this contract shall be expressed in number of calendar days required to make delivery after receipt of order (A/R/O). Product required herein is considered by the State as ongoing needs and shall be guaranteed by the resulting contractor. From time-to-time NYSP may specify a different delivery timeframe which shall be noted on the Purchase Order. Delivery shall be made in accordance with instructions on Purchase Order from the NYSP.

4.6 Warranty

Normal wear and tear items shall be warrantied in accordance with the manufacture’s standard warranty. Where accessories are to be supplied, they must be compatible with the rest of the product. Bidder shall submit all warranties associated with any product supplied under the resultant Contract awarded from this RFP. All product warranties shall survive the termination of any resulting Contract.

RFP-C002422 Cyber Threat Intelligence Platform Page 18

5. Contract Clauses and Requirements

5.1 Appendix A

Appendix A – Standard Clauses for New York State Contracts, dated June 2023, attached hereto, is hereby expressly made a part of this solicitation document as fully as if set forth at length herein. Please retain this document for future reference.

5.2 Appendix B

Appendix B – General Specifications, dated April 2016, attached hereto, is hereby expressly made a part of this solicitation document as fully as if set forth at length herein and shall govern any situations not covered by this solicitation document or Appendix A. Please retain this document for future reference.

5.3 Appendix C

Appendix C – Contractors Requirements and Procedures for Participation by New York State Certified Minority and Women-Owned Business Enterprises and Equal Employment Opportunities for Minority Group Members and Women, attached hereto, is hereby expressly made a part of this solicitation document as fully as if set forth at length herein and shall govern any situations not covered by this solicitation document or Appendix A. Please retain this document for future reference.

5.4 Order of Precedence

The agreement resulting from a successful award will include the following documents. Conflicts between these documents will be resolved in the following descending order of precedence:

1. Appendix A (dated June 2023)

2. Contract Agreement

3. Appendix B (dated April 2016)

4. This Request for Proposals RFP-C002422 including any Addenda (if any)

5. Selected Contractor’s Bid, including Attachment 1 – Cost Proposal, Attachment 2 - Technical Proposal Checklist, and Technical Proposal.

5.5 SAM.gov Requirements

The winning vendor may be required to have an active registration in good standing on the federal www.SAM.gov website.

Following bid closure, if it is determined that SAM.gov registration is required by the federal funding source and the tentatively awarded bidder is not registered or will not promptly register on SAM.gov, the Authorized User reserves the right to disqualify the bidder.

5.6 National Institute of Standards and Technology (NIST)

NYSP will only procure end point devices that shall be consistent with any relevant standards, guidelines or guidance developed as part of the National Institute of Standards and Technology (NIST) Cybersecurity Framework.

5.7 Gender-Based Violence and the Workplace Requirement

State Finance Law §139-M requires bidders on competitive state procurements to certify that they have a Gender-Based Violence and the Workplace policy. The policy must meet the NYS Office for the Prevention of Domestic Violence model policy minimum standards, and the bidder must provide that policy to all its employees.

If the bidder does not have a Gender-Based Violence and the Workplace policy in place and cannot submit a certification, the bidder may provide a statement with their bid detailing the reasons why the certification cannot be made. New York State Police will determine if the justification is acceptable.

A template certification document is being provided as part of this RFP. Applicants must complete and return the certification with their bid or provide a signed statement detailing why the certification cannot be made.

The NYS Office for the Prevention of Domestic Violence provides information about this requirement and has resources available to assist in developing and implementing a Gender-Based Violence and the Workplace policy. Please visit the OPDV Gender-Based Violence and the Workplace website.

RFP-C002422 Cyber Threat Intelligence Platform Page 19

5.8 Procurement Lobbying Requirement

Pursuant to State Finance Law §139-j and §139-k, this…