RFQ-Q&A Final.pdf

Telemetry Indexing and Querying Solutions

Request for Information (RFI)

DMS-25/26-244

Questions and Answers

DMS-25/26-244 Page 2 of 5

QUESTIONS AND ANSWERS

Note: All written questions are reproduced in the same format as submitted by the Respondent.

NO. QUESTION ANSWER

1.

Data Ingestion & Cost Control

What specific controls, thresholds, or architectural requirements will the Department mandate to prevent uncontrolled cost escalation in ingestion-based pricing models as telemetry volume increases?

The Department is seeking information on pricing models and cost considerations, and any requirements will be determined if a procurement is initiated.

2. Telemetry Strategy (Signal vs. Volume)

Will the Department require vendors to demonstrate how their solution prioritizes high-fidelity security telemetry over bulk log ingestion, and how these impacts both cost and detection quality?

This RFI is for informational purposes only.

Vendors should describe capabilities as outlined in the RFI. Potential vendors identified for demonstrations or proofs of concept may be asked to demonstrate capabilities indicated in their response.

Contractual requirements, deliverables, and/or Service Level Agreements (SLAs) will be determined if a procurement is initiated.

3. Detection Engineering Responsibility

What level of responsibility is expected from the vendor to provide, maintain, and continuously improve detection logic versus relying on FLDS personnel to build and tune detections internally?

This RFI is for informational purposes only.

Vendors should describe capabilities as requested in sections A, D, and H.

Contractual requirements, deliverables, and/or Service Level Agreements (SLAs) will be determined if a procurement is initiated.

4. Native Threat Intelligence Integration

Will the Department require that threat intelligence be natively embedded and continuously operationalized within detection logic, rather than requiring manual enrichment or external correlation?

This RFI is for informational purposes only.

Vendors should describe capabilities as outlined in the RFI. Potential vendors identified for demonstrations or proofs of concept may be asked to demonstrate capabilities indicated in their response.

Contractual requirements, deliverables, and/or Service Level Agreements (SLAs) will be determined if a procurement is initiated.

DMS-25/26-244 Page 3 of 5

5. False Positive Reduction Expectations

What measurable expectations does the Department have for reducing false positives at the platform level, and how will vendors be required to demonstrate improved signal fidelity?

This RFI is for informational purposes only.

Vendors should describe capabilities as outlined in the RFI. Potential vendors identified for demonstrations or proofs of concept may be asked to demonstrate capabilities indicated in their response.

Contractual requirements, deliverables, and/or Service Level Agreements (SLAs) will be determined if a procurement is initiated.

6. SOC Analyst Workload Impact

How will the Department evaluate whether a solution reduces analyst workload (e.g., alert triage, investigation time, case volume), and are vendors required to provide evidence of this impact?

This RFI is for informational purposes only;

any requirements, deliverables, and/or Service Level Agreements (SLAs) will be determined if a procurement is initiated.

7. Detection Model Preference

Does the Department expect vendors to rely primarily on customer-built correlation rules, or to deliver pre-built, continuously updated detections that operate across multiple data sources without manual rule creation?

The RFI does not prescribe a detection model; vendors should describe capabilities as requested in sections A, D, and H. This RFI is for informational purposes only; any requirements, deliverables, and/or Service Level Agreements (SLAs) will be determined if a procurement is initiated.

8. Retention vs. Operational Value

What requirements will the Department enforce to ensure that data retention strategies do not introduce unnecessary cost or performance overhead without delivering proportional detection or investigative value?

This RFI is for informational purposes only;

any requirements, deliverables, and/or Service Level Agreements (SLAs) will be determined if a procurement is initiated.

9. Detection Validation & Testing

Will vendors be required to demonstrate how detection logic is continuously validated against real-world adversary behaviors, and how detection effectiveness improves over time without manual intervention?

This RFI is for informational purposes only.

Vendors should describe capabilities as outlined in the RFI. Potential vendors identified for demonstrations or proofs of concept may be asked to demonstrate capabilities indicated in their response.

Contractual requirements, deliverables, and/or Service Level Agreements (SLAs)

DMS-25/26-244 Page 4 of 5

10. Outcome-Based Performance Metrics

Beyond technical capabilities, will the Department require vendors to demonstrate measurable improvements in mean-time-to-detect (MTTD) and mean-time-to-respond (MTTR), and if so, how will this be evaluated?

This RFI is for informational purposes only.

Vendors should describe capabilities as outlined in the RFI. Potential vendors identified for demonstrations or proofs of concept may be asked to demonstrate capabilities indicated in their response.

Contractual requirements, deliverables, and/or Service Level Agreements (SLAs) will be determined if a procurement is initiated.

11. Microsoft Licensing

Can DMS provide information on the current Microsoft licensing posture across participating state agencies (e.g., Microsoft 365, Azure, Security, or Defender licensing), including general licensing tiers and approximate quantities, to help vendors understand baseline capabilities and integration considerations?

The department cannot provide information on current licensing posture of enterprise agencies. Vendors should describe capabilities as outlined in the RFI, including Section B (Integrations).

12. Existing Security Tooling and Contractual Constraints

Can DMS share high level information on existing enterprise or agency level security tools currently in use (such as endpoint detection and response platforms), including whether there are any contractual commitments, vendor lock ins, or transition considerations that should be considered when evaluating proposed telemetry indexing and querying solutions

Replacement of agency security tooling is not being considered. Vendors should describe capabilities as outlined in the RFI.

13. Training Expectations

Are there preferred or required training formats (e.g., hands on SOC training, administrator training, executive reporting)?

As outlined in Section C (Implementation), vendors should describe available training capabilities. Training materials and curricula that can be incorporated into structured training programs, including continued access beyond the implementation phase, are preferred where available; however, any contractual requirements, deliverables, and/or Service Level Agreements (SLAs) will be determined if a procurement is initiated.

DMS-25/26-244 Page 5 of 5

14. Architecture & Deployment Model

Does DMS envision a centralized enterprise telemetry platform operated by FLDS, a federated/multi workspace model managed by individual agencies, or a hybrid of both?

See Section A. Platform Specifications, specifically A(j).

15. Multi Agency Data Segregation

What level of logical data segregation does FLDS expect future solutions to support (e.g., agency based, environment based, or data classification based separation)?

This RFI is for informational purposes only.

Vendors should describe capabilities as outlined in the RFI, specifically section A(l).

Contractual requirements, deliverables, and/or Service Level Agreements (SLAs) will be determined if a procurement is initiated.

16. Scale & Growth Assumptions

Can DMS share high level assumptions or targets regarding anticipated telemetry volume and growth to help vendors design scalable and cost controlled architectures?

Telemetry volume and growth are impacted by many factors and estimates are not currently available.

17. Scale & Growth Assumptions

Can DMS share high level assumptions or targets regarding anticipated telemetry volume and growth to help vendors design scalable and cost controlled architectures?

Telemetry volume and growth are impacted by many factors and estimates are not currently available.

18. Data Residency & Support Expectations

Does DMS anticipate requiring U.S. only data residency and U.S. based support personnel for future telemetry indexing and querying solutions

Vendors should describe capabilities as outlined in the RFI, specifically section G.

Contractual requirements, deliverables, and/or Service Level Agreements (SLAs)

End of Questions and Answers.