Solicitation_Documents_Combined.pdf

TABLE OF CONTENTS

REQUEST FOR QUOTE (RFQ) 1

1. General Information 2

1.1. Method of Award 2

1.2. Bidder Instruction DGS PD 451 2

1.3. Award of the Purchase Order (PO) 2

1.4. Document Attachments 2

1.5. Cloud Computing Software as a Service (SaaS) General Provisions 2

1.6. Software License and Maintenance Fees 3

1.7. Small Business Preference 3

1.8. DVBE Incentive 4

1.9. Suppliers Responding 4

2. Administrative Requirements 5

2.1. Cover Sheet 5

2.2. DSH Cost Table 5

2.3. Commercially Useful Function (CUF) Documentation 5

2.4. STD 204, Payee Data Record 5

2.5. Bidder Declaration (GSPD-05-105) 6

2.6. DVBE Declaration 6

2.7. Seller's Permit 6

2.8. California Civil Rights Laws Certification 6

2.9. Darfur Contracting Act Certification 7

2.10. Delivery 7

2.11. SOW CONTACT INFORMATION 7

2.12. GenAI Technology Use & Reporting 7

ATTACHMENT 1: COVER SHEET 9

ATTACHMENT 2: DSH COST TABLE 10

ATTACHMENT 3: COMMERCIALLY USEFUL FUNCTION DOCUMENTATION 11

ATTACHMENT 4: NuHarbor_SOC_SOW 10.9.26.pdf 12

Request for Quote (RFQ) #: 96 IDEA1496 NuHarbor Monitoring Splunk Open Market (Competitive)

Please review this RFQ and if interested in responding, submit a quotation via the Vendor Submission Portal. Fax quotations will not be accepted. To be considered responsive, the quotation must be received by the RFQ Due Date, and the Administrative Requirements listed below must be included in the Supplier’s submitted quotation. In submitting a proposal, Proposers agree that they have read, understood, and will comply with the instructions found herein. Failure to comply with any of the requirements may result in rejection of a Proposer's proposal. By submitting a response, Proposers agree to the terms and conditions stated in this solicitation and any resulting agreement.

Release of RFQ: October 09, 2026 RFQ Due Date: October 23, 2026 12:00 PM

Jasmine McKenzie jasmine.mckenzie@dsh.ca.gov

(916) 654-2597

ACTION DATES

DSH Procurement Office Contact

1. General Information

1.1. Method of Award

DSH reserves the right to determine the successful quotations(s) either on the basis of individual items or on the basis of all items included in its RFQ, unless otherwise expressly provided in DSH’s RFQ. Unless the supplier specifies otherwise in its quotation, DSH may accept any item or groups of items of any quotation. DSH reserves the right to modify or cancel in whole or in part it’s RFQ at any time.

1.2. Bidder Instruction DGS PD 451

The following Bidder Instructions contains information to assist in the bidder in submitting their response. Form DGS PD 451, Bidder Instructions – Effective 11/09/2011 https://www.dgs.ca.gov/-/media/Divisions/PD/PTCS/GSPD/Bidders-Instructions.ashx

1.3. Award of the Purchase Order (PO)

Award of the Purchase Order (PO) will be made to the supplier that meets all of the Section 2.

Administrative Requirements stated below and provides the lowest net cost quotation.

1.4. Document Attachments

If applicable, the following documents will be attached to this solicitation and will be made as part of the Purchase Order: Attachment 4: Statement of Work and Budget Details and Payment Provisions.

1.5. Cloud Computing Software as a Service (SaaS) General Provisions https://www.dgs.ca.gov/-/media/Divisions/PD/PTCS/GSPD/Bidders-Instructions.ashx

Cloud Computing Software as a Service (SaaS) General Provisions, revised and effective 02/20/ 2025 that are published in the link below will be incorporated and made part of the PO by reference.

No other terms, conditions, policies or general provisions from the supplier are applicable or operative. A quotation that includes a supplier’s policy, terms and/or conditions may be rejected.

Information Technology - General Provisions Cloud - Computing Services Form - DGS PD

402-ITGP

1.6. Software License and Maintenance Fees

Software license and maintenance fees are considered subscriptions. Any purchase order awarded to a supplier for software support and maintenance for 12 months or longer will be paid for the first year only and must be invoiced on an annual basis for the remaining subscription period.

1.7. Small Business Preference

Suppliers who request and qualify as a California-certified small business will be given a five (5) percent preference for bid evaluation purposes only.

In addition, a five (5) percent bid preference is available to a non-small business claiming 25 percent California-certified small business subcontractor participation. Suppliers claiming this preference must be certified by California as a small business or must commit to subcontract at least 25 percent of the net bid price with one or more California-certified small businesses.

Small Business Nonprofit Veteran Services Agencies (SB/NVSA) prime Suppliers meeting requirements specified in the Military and Veterans Code §999.50 et seq. and obtaining a California certification as a small business are eligible for the five (5) percent small business preference.

Suppliers desiring to claim this preference must choose a Small Business Preference Statement(s) required at the following link: https://www.documents.dgs.ca.gov/dgs/fmc/pdf/std830.pdf https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.dgs.ca.gov%2F-%2Fmedia%2FDivisions%2FPD%2FAcquisitions%2FSolicitation-Document-Attachments%2FIT-General-Provisions-Cloud-DGS-PD-402ITGP-Revised-02202025.pdf&data=05%7C02%7CJeanette.Anderson%40dsh.ca.gov%7Cdf378ca0396a4ef6798e08dd55cec2dc%7C807536a6a6b14893a01370509c59ebbb%7C0%7C0%7C638761068706679351%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=5CbCK9YRW70o3NolbdYDCxW5FNYbb8O%2BwyT7%2BIKbgQQ%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.dgs.ca.gov%2F-%2Fmedia%2FDivisions%2FPD%2FAcquisitions%2FSolicitation-Document-Attachments%2FIT-General-Provisions-Cloud-DGS-PD-402ITGP-Revised-02202025.pdf&data=05%7C02%7CJeanette.Anderson%40dsh.ca.gov%7Cdf378ca0396a4ef6798e08dd55cec2dc%7C807536a6a6b14893a01370509c59ebbb%7C0%7C0%7C638761068706679351%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=5CbCK9YRW70o3NolbdYDCxW5FNYbb8O%2BwyT7%2BIKbgQQ%3D&reserved=0 https://www.documents.dgs.ca.gov/dgs/fmc/pdf/std830.pdf

1.8. DVBE Incentive

For suppliers that request and qualify for the Disabled Veteran Business Enterprise (DVBE) Incentive, in accordance with Military and Veterans Code §999.5(a), an incentive will be given to suppliers who provide DVBE participation. For evaluation purposes only, DSH shall apply an incentive to the quotations that propose California certified DVBE participation as identified on the Section 2.5. Bidder Declaration (GSPD-05-105) and confirmed by DSH. The incentive amount for the lowest net cost quotation will vary in conjunction with the percentage of DVBE participation. The following table identifies the percentages that will be used to adjust the net quotation price when calculating the DVBE Incentive:

Confirmed DVBE Participation of: DVBE Incentive:

5 percent and Over 5 percent

4 percent – 4.99 percent inclusive 4 percent

3 percent – 3.99 percent inclusive 3 percent

Suppliers responding to this solicitation who have been certified by California as a DVBE (or who are offering rental equipment and have obtained the participation of subcontractors certified by California as a DVBE) must also submit a completed form(s) STD. 843 (Disabled Veteran Business Enterprise Declaration). The form link is as follows: https://www.documents.dgs.ca.gov/dgs/fmc/gs/pd/pd_8 43.pdf

All disabled veteran owners and disabled veteran managers of the DVBE(s) must sign the form(s).

The completed form should be included in the solicitation response. At DSH’s option prior to award, contractors responding to a solicitation may be required to submit additional written clarifying information. Failure to submit the requested written information as specified may be grounds for quotation rejection.

https://www.documents.dgs.ca.gov/dgs/fmc/gs/pd/pd_843.pdf

1.9. Suppliers Responding

All Suppliers responding to this solicitation must complete the Bidder Declaration GSPD-05-105 and include it with their response. When completing the declaration, Suppliers responding to the solicitation, if applicable, must identify all subcontractors proposed for participation in the contract.

Suppliers awarded a PO/Contract as a result of this solicitation are contractually obligated to use the subcontractors for the corresponding work identified unless the State agrees to a substitution and it is incorporated by amendment to the PO/Contract. The Section 2.5. Bidder Declaration (GSPD-05-105) form link is in the Section 2. Administrative Requirements below.

2. Administrative Requirements

Please complete, sign and return all required administrative documents listed below.

2.1. Cover Sheet

ATTACHMENT 1: COVER SHEET

2.2. DSH Cost Table

ATTACHMENT 2: DSH COST TABLE

2.3. Commercially Useful Function (CUF) Documentation

ATTACHMENT 3: COMMERCIALLY USEFUL FUNCTION DOCUMENTATION

2.4. STD 204, Payee Data Record

STD 204, Payee Data Record http://www.documents.dgs.ca.gov/dgs/fmc/pdf/std204.pdf

2.5. Bidder Declaration (GSPD-05-105)

Bidder Declaration (GSPD-05-105) must be completed and attached using the link below:

https://www.documents.dgs.ca.gov/dgs/fmc/gs/pd/gspd05-105.pdf Vendors who have been certified by California as a DVBE (or who are providing rental equipment and have obtained the participation of subcontractors certified by California as a DVBE) should also submit a completed form(s) STD. 843 (Disabled Veteran Business Enterprise Declaration). All disabled veteran owners and disabled veteran managers of the DVBE(s) must sign the form(s).

Form - STD. 843 (Rev. 11/2005) (ca.gov)

2.6. DVBE Declaration

If DVBE is claimed, a DVBE Declarations (STD 843) must be completed and attached using the link below:

2.7. Seller's Permit

Seller’s Permit - A copy of the permit is required for any tangible goods purchased

2.8. California Civil Rights Laws Certification

California Civil Rights Laws Certification (contracts $100,000 and over) must be completed and attached using the link below:

https://www.dgs.ca.gov/-/media/Divisions/OLS/Forms/CALIFORNIA-CIVIL-RIGHTS-LAWS-ATTA CHMENT.pdf http://www.documents.dgs.ca.gov/dgs/fmc/pdf/std204.pdf https://www.documents.dgs.ca.gov/dgs/fmc/gs/pd/gspd05-105.pdf https://www.documents.dgs.ca.gov/dgs/fmc/gs/pd/pd_843.pdf https://www.documents.dgs.ca.gov/dgs/fmc/gs/pd/pd_843.pdf https://www.dgs.ca.gov/-/media/Divisions/OLS/Forms/CALIFORNIA-CIVIL-RIGHTS-LAWS-ATTACHMENT.pdf https://www.dgs.ca.gov/-/media/Divisions/OLS/Forms/CALIFORNIA-CIVIL-RIGHTS-LAWS-ATTACHMENT.pdf

2.9. Darfur Contracting Act Certification

The Darfur Contracting Act Certification must be completed and attached using the link below:

https://www.documents.dgs.ca.gov/dgs/FMC/GS/PD/PD_1.pdf

If your company, within the previous three years, has done business activites or other operations outside of the United States, you are required to complete this form.

2.10. Delivery

Final delivery, inspection and acceptance shall be at the location described in the "Ship To" address.

2.11. SOW CONTACT INFORMATION

Please complete the following information regarding the Primary and Back up Point of Contact (POC) for the duration of the contract. This information will be used to complete the language in the Statement of Work. This document is required

First, download this file. Then after you've completed it, please export it and attach it below.

2.12. GenAI Technology Use & Reporting

The State of California seeks to realize the potential benefits of GenAI, through the development and deployment of GenAI, while balancing the risks of these technologies.

Bidder/Offeror must notify the State in writing if it: (1) intends to provide GenAI as a deliverable to the State; or (2), intends to utilize GenAI, including GenAI from third parties, to complete all or a portion of any deliverable that materially impacts: (i) functionality of a State system, (ii) risk to the State, or https://www.documents.dgs.ca.gov/dgs/FMC/GS/PD/PD_1.pdf https://sb-public-files.s3.us-gov-west-1.amazonaws.com/SOW+CONTACT+INFORMATION+x+(1).pdf

(iii) Contract performance. For avoidance of doubt, the term "materially impacts" shall have the meaning set forth in State Administrative Manual (SAM) 4986.2.

Failure to report GenAI to the State may result in disqualification. The State reserves its right to seek any and all relief it may be entitled to as a result of such non-disclosure.

Upon notification by a Bidder/Offeror of GenAI as required, the state reserves the right to incorporate GenAI Special Provisions into the final contract or reject bids/offers that present an unacceptable level of risk to the state.

Government Code 11549.64 defines “Generative Artificial Intelligence (GenAI)” as an artificial intelligence system that can generate derived synthetic content, including text, images, video, and audio that emulates the structure and characteristics of the system’s training data.

https://www.dgs.ca.gov/Resources/SAM/TOC/4900/4986-2 https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=GOV&sectionNum=11549.64.&highlight=true&keyword=Generative%20Artificial%20Intelligence

ATTACHMENT 1: COVER SHEET

The Cover Sheet must be completed by all bidders. If this document is incomplete or not provided, the bidder may be deemed non-responsive.

The RFQ Cost Table must be completed by all bidders. If this document is incomplete, calculations are incorrect or the document is not provided, the bidder may be deemed non-responsive.

The Commercially Useful Function Documentation must be completed by all bidders. If this document is incomplete, calculations are incorrect or the document is not provided, the bidder may be deemed non-responsive.

DSH RFQ # IDEA1496

Contractor Name (TBD)

NuHarbor Monitoring Splunk

Exhibit A – Statement of Work

1. OVERVIEW

Vendor provides a managed service for Splunk® Enterprise Security up to 100 SVC (the “Managed Services”). Under the Managed Services, Vendor shall assist Client with monitoring and investigating security and system health alerts in Splunk (“Splunk”). The Managed Services may include both proprietary and third-party software solutions. The Managed Services, and any software employed by Vendor, may be revised, or modified by Vendor from time to time in its sole discretion so long as it continues to meet Vendor’s obligations under this Statement of Work for implementation and monitoring services.

2. CONTRACTED PARTIES:

This agreement is between the Department of State Hospitals (DSH), and Contractor, (TBD) .

3. SCOPE:

1. Vendor will perform the following activities as part of the Managed Service:

a. Security Review: Vendor shall search for anomalies with daily reviews of Client’s Splunk environment. By reviewing alerts and dashboards, Vendor identifies potentially malicious activity. Based on review outcomes, Vendor filters false positives, investigates potential threats, and escalates valid security incidents according to Client’s Escalation Plan, as defined in writing during onboarding.

b. Security Rule Tuning: Based on Vendor’s security review or client feedback, Vendor shall tune Client’s environment to reduce false positives and increase coverage.

c. Notable Event Investigation: Vendor shall escalate a notable event after performing a first level investigation to determine if it warrants client attention.

d. Security Use Case Development: Vendor will use Splunk to identify and communicate security incidents to Client and adjust notification procedures as needed. Current security incidents identified and evaluated by Vendor are listed in Schedule A. Schedule A may be modified by Vendor from time to time according to the mutually agreed upon rules of engagement established during client onboarding.

e. Splunk Administration: Vendor assists in maintaining the health of Client’s Splunk environment. Vendor monitors the health of Client’s Splunk infrastructure including search heads, indexers, deployment servers, and other Splunk systems supporting the Client environment.

f. Splunk Upgrades: Vendor supports the upgrades needed for Client’s Splunk environment by providing an upgrade path, determining the order to upgrade certain systems, and assisting in performing the actual upgrades.

g. Splunk Dashboards and Searches: Vendor will develop dashboards, reports, and saved searches based on Client requirements. Vendor will work with Client to determine data sources required to construct the dashboards and searches.

h. Data Source Onboarding: Vendor will onboard data sources into Splunk Enterprise security. This includes installing required technology add-ons, field extraction work, and Common Information Model normalization.

i. Service Desk Integration: Vendor will integrate the Vendor JIRA Service Desk with the client native service desk (ServiceNow) using third party software (ConnectAll).

j. Threat Intelligence: The Vendor CTAC team collects, analyzes, and distributes threat intelligence for all clients. Curated Threat intelligence is delivered to the client Splunk instance where it is incorporated into the Splunk Enterprise Security threat intelligence framework. Clients receive:

i. 50+ OSINT threat intelligence feeds

ii. Vendor global threat intelligence feeds

iii. Biweekly global threat intelligence trend reporting

2. Service Level Objectives (SLOs):

2.1 Service Level Objective. Vendor strives to meet its Service Level Objectives and to serve its Clients to the fullest extent possible. However, not all threats to a Client’s system can be identified and the ability of Vendor to meet the Service Level Objectives depends on systems and software outside of Vendor’s control (e.g., external security controls, external data sources, and bugs in the Splunk software).

2.2 Critical Events. Vendor analyst shall evaluate security and system health events according to their urgency designations based on the service level objective defined in table 1.2.f. Investigations commence when the analysts review the triggered event. Lower severity evaluations will be placed on hold for evaluations related to newer, more severe, events. Outside of regular business hours (8-5pm EST, Monday-Friday) and on holidays, evaluations are limited to critical severity events only. All evaluations are focused on ruling out false positives using Vendor’s knowledge of Client network and data available in Splunk.

2.3 NuHarbor Holidays. Vendor observes the following holidays:

i. New Year’s Day

ii. Martin Luther King, Jr. Day

iii. Presidents Day

iv. Memorial Day

v. Independence Day

vi. Labor Day

vii. Veterans Day

viii. Thanksgiving Day

ix. Christmas Day

x. Holidays that fall on Saturday are observed the preceding Friday.

xi. Holidays that fall on Sunday are observed the following Monday.

2.4 Escalations. Critical security events are client escalated or automated security alerts (Notable Events) generated in Splunk with a “Critical” urgency. Critical alerts are high-fidelity, low false-positive events that must be actioned immediately.

2.5 Health Monitoring. Critical system alerts are automated system health monitoring events that threaten the performance, or availability of the Splunk platform and critical data sources. Critical events and data sources are mutually determined during service onboarding.

2.6 Due Dilligence. If Vendor fails to meet any SLOs and client has demonstrated due diligence for all client responsibilities and provided timely communication, Client’s remedy shall be to receive a credit equal to one (1) days’ worth of the applicable fees for each daily period for which the respective SLO was not met and for that respective service. The total maximum annual credit provided by Vendor for missed SLOs will not exceed the total annual fee. The amount Client will be credited for SLO breaches is calculated by taking the annual fee of the service and dividing by 365. Credits shall be applied against the next invoice payable by client.

2.7 The following table lists service level objectives (SLO).

Category Frequency Urgency Description Minimum Objective

Security Incident Escalation

24x7x365 Multiple During the investigation of alerts the Analyst team identifies that an event is a true positive and provides the CLIENT with an escalation

60 minutes from determination

Security Event Triage

24x7x365 Critical Receive an automated security alert at the designated urgency and begin triage

30 minutes

Security Event Triage

24x7x365 CLIENT Critical Escalation

CLIENT initiates a critical incident for investigation through the Vendor 24x7 phone system

60 minutes from determination

Security Event Triage

8x5xNBD High Receive an automated security alert at the designated urgency and begin triage

2 hours

Security Event Triage

8x5xNBD Medium Receive an automated security alert at the designated urgency and begin triage

3 Hours

Security Event Triage

8x5xNBD Low Receive an automated security alert at the designated

8 hours urgency and begin triage

Security Event Triage

8x5xNBD Informational Informational events are reviewed monthly since they are configured as contextual data or have an extremely high false negative rate.

4 weeks

Security Incident Investigation

N/A N/A A true positive security incident is declared and investigated.

1h - 5 days depending on scope and complexity

Security Incident Resolution

N/A N/A A true positive security incident is contained.

1h - 5 days depending on scope and complexity

System Alert 24x7 Critical Splunk Alert

Receive an automated alert and start triage

30 minutes

System Alert 24x7 CLIENT Critical Escalation

CLIENT initiates a critical Splunk system event through the Vendor 24x7 phone system

60 minutes from determination

System Alert 8x5xNBD High Splunk Alert

Receive an automated alert and start triage

8 hours

System Alert 8x5xNBD Medium Splunk Alert

Receive an automated alert and start triage

NBD

System Alert 8x5xNBD Low Splunk Alert

Receive an automated alert and start triage

NBD

Development Request

8x5xNBD Development Request

Time to acknowledge

1 business day

Development Request

8x5xNBD Development Request

Time to start 3 business days

Development Request

8x5xNBD Development Request

Time to complete 10 business days from start

*Depends on complexity, client readiness and responsiveness.

2.8 Coverage and Support. All work performed by Vendor shall be performed remotely. All deliverables provided to Client, including, but not limited to reports and communications, will use Vendor’s proprietary templates, formats, and structure.

2.9 Communications. Vendor shall provide regular reporting to Managed Service clients:

Biweekly Status Reports

a. Vendor shall provide a biweekly status report via email to the designated Client contact(s). This report covers environment health, security notable event statistics, current ticket status, community threat intelligence trends, and threat statistics.

Quarterly Status Meetings

b. Vendor shall schedule a one-hour phone or web-based conference call between a Vendor analyst and the Client for purposes of reviewing overall health, status, and mutual performance.

Weekly, Biweekly, and Monthly Meetings

c. Vendor may schedule planning, coordination, or review meetings with Client on an ongoing basis as reasonably necessary and mutually agreed by the Parties.

3. Splunk Alert Escalations

3.1 During onboarding, Vendor and Client will define escalation guidelines as part of the defined rules of engagement document. Escalation guidelines will govern which communication method both Parties will use to notify either party of a system alert or security escalation based on severity. Approved communication methods are:

a. 1. Vendor JIRA ticketing portal

b. 2. Telephone

4. Splunk Concierge Requests & General Security Requests

4.1 All Managed Services requests will be submitted through Vendor Security’s JIRA service desk. Clients will receive access to the service desk where they can submit, review, and update each request.

5. Exclusions

The following items are excluded from this SOW. Vendor can supply services for these items through a separate Statement of Work.

5.1 Security Monitoring Exclusions:

a. Vendor will only monitor client defined correlation searches after validating the correlation searches meet Vendor’s confidence requirements. In the event a correlation search does not meet confidence requirements, Vendor will work with the clients to refine the search or replace the search.

5.2 Development Exclusions:

a. Major Splunk system component migrations. For example:

i) Migrations to new hardware

ii) Migrations between on-premises and cloud infrastructure

b. Deployment of new system components. For example:

i) Deploying new syslog servers.

ii) Deploying new Splunk system components (e.g., search heads, indexers, and forwarders).

6. Client Obligations

In order for Vendor to provide services, Client shall:

a. Provide remote access to Splunk within Client’s computing environment.

b. Provide remote access to the Client’s Splunk computing environment using any of the following methods:

c. Provide appropriately permissioned user accounts.

d. Be responsible for hardware, infrastructure, backups, and patching operating system.

7. Security Use Cases

Vendor will implement security use cases in Splunk Enterprise Security based on Vendor’s understanding of the clients’ threat profile. The following table provides a sample list of correlation searches developed by Vendor and their associated mappings to the MITRE Enterprise ATT&CK Framework.

Search Name ATT&CK ID Tactic Technique

NH - Account Creation T1136 Persistence Create Account

NH - Anomalous Login Activity T1110.004 Credential Access

Brute Force: Credential Stuffing

NH - Anomalous Login Activity T1110.003 Credential Access

Brute Force: Password Spraying

NH - Anomalous Login Activity T1110.001 Credential Access

Brute Force: Password Guessing

NH - Audit Log Cleared T1070 Defense Evasion Indicator Removal on Host

NH - Crowdstrike Alerts T0000 N/A CrowdStrike detection, variable MITRE mapping

NH - DHCPv6 Spoofing/MITM6 Attack

T1557 Credential Access Collection

Man-in-the-Middle

NH - Flagged Logon with Explicit Credentials

T1021.002 Lateral Movement

Remote Services:

SMB/Windows Admin Shares

NH - Flagged Logon with Explicit Credentials

T1053.005 Execution Persistence Privilege Escalation

Scheduled Task/Job:

Scheduled Task

NH - Flagged Logon with Explicit Credentials

T1569.002 Execution System Services: Service Execution

NH - Flagged Logon with Explicit Credentials

T1047 Execution Windows Management Instrumentation

NH - Flagged Logon with Explicit Credentials

T1059.001 Execution Command and Scripting Interpreter: PowerShell

NH - Flagged Logon with Explicit Credentials

T1078 Defense Evasion Persistence Privilege

Valid Accounts

NH - Flagged Logon with Explicit Credentials

T1569.002 Execution System Services: Service Execution

NH - Flagged VPN to RDP Lateral Movement

T1133 Persistence Initial Access

External Remote Services

NH - Flagged VPN to RDP Lateral Movement

T1021.001 Lateral Movement

Remote Services: Remote Desktop Protocol

NH - General IDS Attacks T1059.001 Execution Command and Scripting Interpreter: PowerShell

NH - General IDS Attacks T1071.001 Command and Control

Application Layer Protocol:

Web Protocols

NH - General IDS Attacks T1071.001 Command and Control

Application Layer Protocol: File Transfer Protocols

NH - General IDS Attacks T1071.001 Command and Control

Application Layer Protocol: Mail Protocols

NH - General IDS Attacks T1071.001 Command and Control

Application Layer Protocol:

DNS

NH - General IDS Attacks T1595 Reconnaissance Active Scanning

NH - General Malware Detections T1486 Impact Data Encrypted for Impact

NH - General Malware Detections T1204.002 Execution User Execution: Malicious File

NH - General Malware Detections T0000 N/A Generic Malware Detection

NH - Insecure Authentication Detected

T1552 Credential Access

Unsecured Credentials

NH - Kerberos Attacks T1558 Credential Access

Steal or Forge Kerberos Tickets: Kerberoasting

NH - Kerberos Attacks T1110 Credential Access

Brute Force: Password Spraying

NH - SMB Scanning Detected T1190 Initial Access Exploit Public-Facing Application

NH - SMB Scanning Detected T1021.002 Lateral Movement

Remote Services:

SMB/Windows Admin Shares

NH - Suspicious Exploitation DNS T1588.002 Resource Development

Obtain Capabilities: Tool

NH - Suspicious Exploitation DNS T1016 Discovery System Network Configuration Discovery

NH - Suspicious Exploitation DNS T1071.001 Command and Control

Application Layer Protocol:

Web Protocols

NH - Suspicious Exploitation DNS T1071.004 Command and Control

Application Layer Protocol:

DNS

NH -

Suspicious Powershell Commands

T1059.001 Execution Command and Scripting Interpreter: PowerShell

NH -

Suspicious Powershell Commands

T1027 Defense Evasion Obfuscated Files or Information

NH - Suspicious Processes T1047 Execution Windows Management Instrumentation

NH - Suspicious Processes T1134.002 Defense Evasion Privilege Escalation

Access Token Manipulation:

Create Process with Token

NH - Suspicious Processes T1490 Impact Inhibit System Recovery

NH - Suspicious Processes T1069.002 Discovery Permission Groups Discovery:

Domain Groups

NH - Suspicious Processes T1036 Defense Evasion Masquerading

NH - Suspicious Processes T1003 Credential Access

OS Credential Dumping

NH - Suspicious Processes T0000 N/A Possible Trickbot Command

NH - Suspicious Processes T1203 Execution Exploitation for Client Execution

NH - Suspicious Processes T1204 Execution User Execution

NH - Suspicious Processes T1053 Execution Scheduled Task/Job

NH - Suspicious Processes T1053 Persistence Scheduled Task/Job

NH - Suspicious Processes T1053 Privilege Escalation

Scheduled Task/Job

NH - Suspicious Processes T1074.001 Collection Data Staged: Local Data Staging

NH - Suspicious Processes T0000 N/A Exploit Tools

NH - Suspicious Processes T1570 Lateral Movement

Lateral Tool Transfer

NH - Suspicious Processes T1569 Execution System Services

NH - Suspicious Processes T0000 N/A NetCat Tool Usage

NH - Suspicious Processes T1048 Exfiltration Exfiltration Over Alternative Protocol

NH - Suspicious Processes T1135 Discovery Network Share Discovery

NH - Suspicious Processes T1059.004 Execution Command and Scripting Interpreter: Unix Shell

NH - Suspicious Processes T1059 Execution Command and Scripting Interpreter

NH - Suspicious Processes T1059.006 Execution Command and Scripting Interpreter: Python

NH - Suspicious Processes T1190 Initial Access Exploit Public-Facing Application

NH - Suspicious Processes T1083 Discovery File and Directory Discovery

NH - Suspicious Processes T1018 Discovery Remote System Discovery

NH - Suspicious Processes T1110 Credential Access

Brute Force: Password Cracking

NH - Suspicious Processes T0000 N/A Metaploit Tool Usage

NH - Suspicious Processes T1548.001 Privilege Escalation

Abuse Elevation Control Mechanism: Setuid and Setgid

NH - Suspicious Processes T1548.001 Defense Evasion Abuse Elevation Control Mechanism: Setuid and Setgid

NH - Suspicious Processes T1595 Reconnaissance Active Scanning

NH - Suspicious Processes T1040 Discovery Network Sniffing

NH - Suspicious Processes T1087.001 Discovery Account Discovery: Local Account

NH - Suspicious Processes T1039 Collection Data from Network Shared Drive

NH - Suspicious Processes T1087.002 Discovery Account Discovery: Domain Account

NH - Suspicious Processes T0000 N/A General WMIC Usage

NH - Suspicious Processes T1070.001 Defense Evasion Indicator Removal on Host:

Clear Windows Event Logs

NH - Suspicious Processes T1033 Discovery System Owner/User Discovery

NH - Suspicious Processes T1055 Privilege Escalation

Process Injection

NH - Suspicious Processes T1055 Defense Evasion Process Injection

NH - Suspicious Processes T1027 Defense Evasion Obfuscated Files or Information

NH - Suspicious Processes T1071.001 Command and Control

Application Layer Protocol:

Web Protocols

NH - Suspicious Service Installation

T1134.001 Defense Evasion Privilege Escalation

Access Token Manipulation:

Token Impersonation/Theft

NH - Suspicious Service Installation

T1003 Credential

OS Credential Dumping

NH - Suspicious Service Installation

T1021.002 Lateral Movement

Remote Services:

SMB/Windows Admin Shares

NH - Suspicious Service Installation

T1134.002 Defense Evasion Privilege Escalation

Access Token Manipulation:

Create Process with Token

NH - URL Command Injection/Path Traversal

T1595.002 Reconnaissance Active Scanning: Vulnerability Scanning

NH - Users Added to Security- Enabled or Azure Group

T1098 Persistence Account Manipulation

NH - WinEventLog Brute Force Detection

T1110 Credential

Brute Force

8. Operational Roles and Responsibility

The Operational RACI Matrix provides an overview of which tasks Vendor, and CLIENT are responsible for performing as a part of service delivery.

Task Responsibilities Vendor CLIENT

Security Monitoring

1.0 Identify and investigate

suspicious indicators of compromise (IOC) and indicators of attack (IOA) within Splunk Enterprise Security.

X

1.1 Notify Vendor of CLIENT

reported security incidents for investigation in Splunk Enterprise Security.

X

1.2 Investigate CLIENT reported

security incidents within Splunk Enterprise Security.

X

Threat Hunting

2.0 Perform ad-hoc unstructured

threat hunting within Splunk Enterprise Security, from 8am - 5pm EST.

X

2.1 Notify Vendor of specific

threats or risks that CLIENT would like threat hunting to focus on each week. If no guidance is provided Vendor will perform threat hunting based on gathered intelligence.

X

Incident Response

3.0 Escalate security incidents to

CLIENT that meet escalation criteria.

X

3.1 Use Splunk Enterprise Security

to assist in determining incident scope.

X

3.2 Quarantine files, endpoints, or

kill processes that meet response containment guidelines.

X

3.3 Contain endpoints, users, and

systems involved in an incident.

X

3.4 Remediate endpoints, users, and systems involved in an incident.

X

Threat Intelligence

4.0 Configure Splunk Enterprise

Security to leverage the Vendor Threat Intelligence Platform powered by ThreatConnect

4.1 Provide indicators of

compromise (IOC) through open-source threat intelligence feeds. IOC’s include: File Hashes, Domains, IP addresses, URLs, and email addresses.

X

4.2 Authorize Vendor to subscribe

to CLIENT procured threat intelligence feeds (i.e., XX-

ISAC).

X

Development

5.0 Monitor the health and

performance of the Splunk Environment.

X

5.1 Perform patching and

upgrades of Splunk Software Components.

X

5.2 Perform patching and

upgrades of Syslog Software.

X

5.3 Perform configuration of existing Syslog Software.

5.4 Perform patching and

hardening of Splunk and Syslog server operating systems.

X

5.5 Identify and communicate

Splunk development needs including dashboards, reports, searches, security use cases, and Splunk Technology Addons and Apps.

X

5.6 Maintain all physical and

virtual hardware.

X

5.7 Onboard agreed upon data

sources a month.

5.8 Develop agreed upon security

use cases per month.

X

5.9 Develop agreed upon reports, saved searches, and dashboards per month.

X

5.10 Install agreed upon Splunk

technology add-ons or applications per month.

6 CONTACTS:

Department of State Hospitals:

C.J. Miller 1215 O Street, MS-4 Sacramento, CA 95814

(916) 951-5585 Email: CJ.Miller@dsh.ca.gov

Contractor Information (TBD) Add: Contractor’s Name:

Address City, State, Zip Phone:

Email:

7 GEN AI TECHNOLOGY USE & REPORTING:

The State of California seeks to realize the potential benefits of GenAI, through the development and deployment of GenAI, while balancing the risks of these technologies.

Bidder/Offeror must notify the State in writing if it: (1) intends to provide GenAI as a deliverable to the State; or (2), intends to utilize GenAI, including GenAI from third parties, to complete all or a portion of any deliverable that materially impacts: (i) functionality of a State system, (ii) risk to the State, or (iii) Contract performance. For avoidance of doubt, the term "materially impacts" shall have the meaning set forth in State Administrative Manual (SAM) 4986.2.

Failure to report GenAI to the State may result in disqualification. The State reserves its right to seek any and all relief it may be entitled to as a result of such non-disclosure.

Upon notification by a Bidder/Offeror of GenAI as required, the state reserves the right to incorporate GenAI Special Provisions into the final contract or reject bids/offers that present an unacceptable level of risk to the state.

Government Code 11549.64 defines “Generative Artificial Intelligence (GenAI)” as an artificial intelligence system that can generate derived synthetic content, including text, images, video, and audio that emulates the structure and characteristics of the system’s training data

8 AGREEMENT TERMS:

The term of this agreement is one year from the date of execution.

9 COST:

Qty Part Number Description Unit Price Line Item Total

1 MS-SPLUNK-

STANDARD

MS-SPLUNK-

STANDARD Splunk Managed Services Standard up to 100 SVC

Total $ The total cost of this agreement is $XXX.XX

10 Terms and Conditions

10.1 IT General Provisions for Cloud Computing Services (Effective 02/20/2025)

LOCATIONS:

The services shall be performed for the Department of State Hospitals at the following location(s):

☐ DSH-Atascadero 10333 El Camino Real P.O. Box 7001 Atascadero, CA 93423-7001

☐ DSH-Coalinga 24511 West Jayne Avenue P.O. 5000 Coalinga, CA 93210

☐ DSH-Metropolitan 11401 South Bloomfield Avenue Norwalk, CA 90650

☐ DSH-Patton 3102 East Highland Avenue Patton, CA 92369

☐ DSH-Napa 2100 Napa-Vallejo Highway Napa, CA 94558-6293

☒ DSH-Sacramento 1215 O Street Sacramento, CA 95814

11 AMENDMENT:

This agreement may be amended at the DSH’s sole discretion to extend the term for up to one (1) additional year and/or to add funding sufficient for that period at the same rates if it does not exceed the DSH’s Purchasing Authority at the time of amendment. Any amendment shall be in writing and approved by both parties and, if applicable, be approved by the Department of General Services/or California Department of Technology.

12 PAYMENT PROVISIONS

12.1 Invoicing and Payment

12.1.1 Contractor shall submit one original and three copies of each invoice, unless emailed.

12.1.2 Invoices shall clearly reference the agreement and PO number.

12.1.3 To expedite the processing of invoices submitted to the DSH for payment, all invoice(s) shall be submitted to the DSH for review and approval at either:

Department of State Hospitals- Accounting Division Attn: Accounts Payable

Address: 1215 O Street, Sacramento, CA 95814 Phone Number: (916) 562-2572

Email: DSHSAC.AccountsPayable@dsh.ca.gov

12.1.4 Licenses shall be paid annually upon each term start date(s).

12.1.5 Hardware Maintenance shall be paid monthly, in arrears.

12.1.6 Hardware Warranty shall be paid in full

12.2 Budget Contingency Clause:

12.2.1 It is mutually agreed that if the Budget Act of the current year and/or any subsequent years covered under this Agreement does not appropriate sufficient funds for the program, this Agreement shall no longer be in full force and effect. In this event, the State shall have no liability to pay any funds whatsoever to Contractor or to furnish any other considerations under this Agreement and Contractor shall not be obligated to perform any provisions of this Agreement.

12.2.2 If funding for any Fiscal Year (FY) is reduced or deleted by the Budget Act for purposes of this program, the State shall have the option to either cancel this Agreement with no liability occurring to the State or offer an Agreement amendment to Contractor to reflect the reduced amount.

12.2.3 If this Agreement overlaps Federal and State FY’s, should funds not be appropriated by Congress or approved by the Legislature for the FY in which the Agreement was entered into, and/or any subsequent years covered under this Agreement, the State may exercise its option to cancel this Agreement.

12.2.4 In addition, this Agreement is subject to any additional restrictions, limitations, or conditions enacted by Congress or the Legislature which may affect the provisions or terms of funding of this Agreement in any manner.

12.3 Prompt Payment Clauses:

12.3.1 Payment will be made in accordance with, and within the time specified in, Government Code section 927, et seq.

12.4 Travel and per Diem

12.4.1 DSH will not pay for Travel or Per Diem.

v.17 Rev. 03/01/2025

EXHIBIT E - HIPAA Business Associate Agreement

CONFIDENTIALITY AND INFORMATION SECURITY PROVISIONS

(HIPAA/HITECH Act contracts)

These Confidentiality and Information Security Provisions for Health Insurance Portability and Accountability Act of 1996 (HIPAA) and Health Information Technology for Economic and Clinical Health (HITECH) Act contracts) set forth the information privacy and security requirements Contractor is obligated to follow with respect to all confidential information (as defined herein) disclosed to Contractor, or collected, created, maintained, stored, transmitted, or used by Contractor for or on behalf of the California Department of State Hospitals (DSH), pursuant to Contractor’s agreement with DSH. DSH and Contractor (the parties) desire to protect the privacy and provide for the security of DSH confidential information pursuant to this Exhibit and in compliance with state and federal laws applicable to the confidential information.

1. CONFIDENTIALITY AND INFORMATION SECURITY PROVISIONS:

A. Contractor shall comply with applicable laws and regulations, including but not limited to Welfare and Institutions Code sections 14100.2 and 5328 et seq., the Lanterman-Petris-Short Act, Civil Code section 1798 et seq., the Information Practices Act of 1977, Health and Safety Code section 123100 et seq., the Patient Access to Health Records Act, Title 42, Code of Federal Regulations (C.F.R.) part 431.300 et seq., and HIPAA, including but not limited to section 1320d et seq. of Title 42 of the United States Code and its implementing regulations (including but not limited to Title 45, Code of Federal Regulations (C.F.R.), parts 160, 162 and 164 (HIPAA regulations) regarding the confidentiality and security of protected health information (PHI). The following provisions of this Exhibit set forth some of the requirements of these statutes and regulations.

This Exhibit should not be considered an exclusive list of the requirements. Contractor is required to fulfill the requirements of these statutes and regulations by independently researching and obtaining legal advice on these requirements as they may be amended from time to time.

B. Order of Precedence: With respect to confidentiality and information security provisions for all DSH confidential information, the terms and conditions of this Exhibit shall take precedence over any conflicting terms or conditions set forth in any other part of the agreement between Contractor and DSH, including Exhibit A (Scope of Work), all other exhibits and any other attachments, and shall prevail over any such conflicting terms or conditions.

C. Effect on lower tier transactions: The terms of this Exhibit shall apply to all contracts, subcontracts, and subawards, and the information privacy and security requirements Contractor is obligated to follow with respect to DSH confidential information disclosed to Contractor, or collected, created, maintained, stored, transmitted or used by Contractor for or on behalf of DSH, pursuant to Contractor’s agreement with DSH. When applicable, the Contractor shall incorporate the relevant provisions of this Exhibit into each subcontract or subaward to its agents, subcontractors, or independent consultants.

2. DEFINITIONS:

A. The following terms used in the agreement between DSH and Contractor shall have the same meaning as those terms in the HIPAA Rules: Breach, Covered Entity, Data Aggregation, Disclosure, Health Care Operations, Individual, Minimum Necessary, Protected Health Information, Secretary, Subcontractor, Unsecured Protected Health Information, and Use.

B. Specific Definitions

i. Contractor. Contractor shall have the same meaning as the term “business associate” at 45 C.F.R. section 160.103.

ii. Breach. With respect to Contractor’s handling of confidential information, “breach” shall have the same meaning as the term “breach” in HIPAA, 45 C.F.R. section 164.402.

iii. HIPAA Rules. HIPAA Rules shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 C.F.R. parts 160 and 164.

iv. Confidential Information. Confidential information is all information and records obtained in the course of providing services to either voluntary or involuntary recipients of services, codified in Welfare and Institutions Code section 5328. Confidential information shall include information or data that is defined as Protected Health Information in HIPAA or Personal Information as defined herein.

v. Personal Information (PI). PI shall have the same meaning as defined in Civil Code section 1798.3, subdivision (a).

vi. Required by law, as set forth under 45 C.F.R. section 164.103, shall mean a mandate contained in law that compels an entity to make a use or disclosure of PHI that is enforceable in a court of law. This includes, but is not limited to, court orders and court-ordered warrants, subpoenas or summons issued by a court, grand jury, a governmental or tribal inspector general, or an administrative body authorized to require the production of information, and a civil or an authorized investigative demand. It also includes Medicare conditions of participation with respect to health care providers participating in the program, and statutes or regulations that require the production of information, including statutes or regulations that require such information if payment is sought under a government program providing public benefits. A mandated use or disclosure that is required by law must be authorized under both federal and state privacy laws and regulations, including those listed in subsection 1.A. above.

vii. Security Incident. Security Incident shall mean the attempted or successful unauthorized access, use, disclosure, modification, or destruction of (1) confidential information, or (2) confidential data that is essential to the ongoing operation of Contractor’s organization and intended for internal use; or (3) interference with system operations in an information system.

viii. Designated Record Set. Designated record set shall mean the group of records maintained for DSH that includes medical, dental, and billing records about individuals;

enrollment, payment, claims adjudication, and case or medical management systems maintained for DSH health plans; or those records used to make decisions about individuals on behalf of DSH.

3. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE:

A. Contractor agrees to:

i. Not use or disclose confidential information other than as permitted or required by the agreement between DSH and Contractor or as required by law. Contractor shall inform DSH of any disclosure required by law that is not contemplated by this agreement, prior to making the disclosure. Any use or disclosure of DSH confidential information shall be the minimum necessary;

ii. Promptly transmit to the DSH Contract Manager all requests for disclosure of any confidential information requested by third parties to the agreement between Contractor and DSH.

iii. Use appropriate safeguards, and comply with Subpart C of 45 C.F.R. part 164 with respect to electronic confidential information, to prevent use or disclosure of confidential information other than as provided for by the agreement with DSH;

iv. Report to DSH any access, use or disclosure of confidential information not provided for by the agreement with DSH of which it becomes aware, including breaches of unsecured protected health information as required at 45 C.F.R. section 164.410, and any security incident of which it becomes aware;

v. in accordance with 45 C.F.R. sections 164.502(e)(1)(ii) and 164.308(b)(2) , if applicable, ensure that any agents and subcontractors that create, receive, maintain, or transmit confidential information on behalf of Contractor enter into a written agreement with Contractor agreeing to be bound to the same restrictions, conditions, and requirements that apply to Contractor with respect to such information;

vi. Provide access and make available confidential information in a designated record set to DSH or to an individual in accordance with 45 C.F.R. section 164.524 and California Health and Safety Code section 123100 et seq. Contractor shall use the forms and processes developed by DSH for this purpose and shall respond to requests for access to records transmitted by DSH within fifteen (15) calendar days of receipt of the request by producing the records or verifying that there are none;

vii. If Contractor maintains electronic health records with PHI and an individual requests a copy of such information in an electronic format, Contractor shall provide such information in an electronic format to enable DSH to fulfill its obligations under the HITECH Act, including but not limited to, 42 U.S.C. section 17935(e);

viii. If Contractor receives data from DSH that was provided to DSH by the Social Security Administration, upon request by DSH, Contractor shall provide DSH with a list of all employees, subcontractors, and agents who have access to the Social Security data, including employees, contractors, and agents of its subcontractors and agents;

ix. Make any amendment(s) to confidential information in a designated record set as directed or agreed to by DSH pursuant to 45 C.F.R. section 164.526, or take other measures as necessary, agreed to by DSH, to satisfy DSH’s obligations under 45 C.F.R. section 164.526;

x. Document and make available to DSH or (at the direction of DSH) to an individual within 15 days such disclosures of PHI, and information related to such disclosures, necessary to respond to a proper request by the individual for an accounting of disclosures of PHI, in accordance with the HITECH Act and its implementing regulations, including but not limited to 45 C.F.R. section 164.528 and 42 U.S.C. section 17935(c).