Unified Data Analytics and Security RFI.pdf

SENSITIVE BUT UNCLASSIFIED

U.S. DEPARTMENT OF STATE

BUREAU OF DIPLOMATIC TECHNOLOGY (DT)

OFFICE OF INFORMATION TECHNOLOGY ACQUISITIONS (ITA)

REQUEST FOR INFORMATION (RFI)

for

UNIFIED PLATFORM FOR DATA ANALYTICS, SECURITY, AND MONITORING

PART 1: REQUEST FOR INFORMATION BACKGROUND AND OBJECTIVES

1.1 PURPOSE

This Request for Information (RFI) is issued as part of market research to determine industry’s capabilities to provide proven commercial-off-the-shelf (COTS) solutions for enterprise data analytics, security, logging, monitoring, and compliance in alignment with the Department of State’s (State) global IT and cybersecurity objectives. The solution shall be capable of meeting federal and State-specific requirements, with capabilities for scalability, flexibility, and integration across diverse environments, including on-premise and cloud deployments.

Additional specific capability requirements are enumerated in Part 2 below.

The U.S. Government (USG) does not commit to award a contract on the basis of this RFI or reimburse any costs associated with the preparation of responses.

This RFI is issued solely for information and planning purposes and does not constitute a solicitation. All information received in response to this RFI that is marked “Proprietary” will be handled accordingly. Responses to the RFI will not be returned. In accordance with FAR 15.201(e), responses to this RFI are not offers and cannot be accepted by the USG to form a binding contract. Responses to this RFI will assist State in determining the potential level of interest, competition adequacy, and technical capabilities of commercial respondents to provide the required products and/or services. The USG does not guarantee any action beyond this RFI.

1.2 BACKGROUND

State’s mission is to advance the interests of the American people, their safety, and economic prosperity by leading America’s foreign policy through diplomacy, advocacy, and assistance. The mission of the Bureau of Diplomatic Technology (DT) is to rapidly and securely deliver, anytime and anywhere, the knowledge resources and Information Technology (IT) services needed to support the over 300 sites and 275 missions it services worldwide.

DT is seeking input from industry regarding their capability to provide market-leading solutions capable of meeting the full breadth of functional requirements outlined in this RFI. State requires access to a platform that is compliant with current Federal security requirements, is easy to use, flexible, scalable, customizable, and configurable to meet specific State requirements as further detailed below.

1.3 RFI OVERVIEW

As further detailed in Section 2, State is seeking to identify capable and interested partners able to provide the products and/or services required to meet the full range of functional capabilities outlined in this RFI. Viable partners shall have demonstrated experience deploying hardware solutions and delivering the ongoing support required to maintain, expand, and upgrade the solution over time for an organization of similar size, global scope, and mission complexity as State within the federal market.

Information requested in this RFI includes the following categories:

• Company Information (Section 1) - Identification of interested respondents, socio-economic status, and potential acquisition vehicles to inform State’s potential acquisition strategy options.

• Capability Assessment Against Functional Requirements (Section 2) - Description of respondent’s proposed technical solutions and ability to fully meet all stated functional requirements.

• Past Experience (Section 3) - Past project example(s) demonstrating respondent’s experience implementing their proposed solutions in the federal environment to address the needs of an organization of similar size, global scope, and mission complexity to State.

1.4 SUBMISSION INSTRUCTIONS

All written responses should be submitted in Microsoft compatible formats (e.g., Word) or PDF.

Responses must use 12-point font and 1-inch margins, including all text, tables, and graphics. Additional attachments such as data sheets providing additional technical details for proposed solutions may also be provided, if necessary, in addition to the page limits stated below. General brochures or other marketing materials not directly relevant to the stated requirements are not requested and will not be considered as part of the response. Response page limit(s) by section are noted below.

• Section 1 – 1 page

• Section 2 – 15 pages

• Section 3 – 5 pages

Please submit all materials to John Warner at WarnerJ1@state.gov by Monday, February 17, 2025 at 12:00pm/ET.

UNDER NO CIRCUMSTANCES SHALL ANY RESPONDENT CONTACT ANY STATE

PERSONNEL REGARDING THIS NOTICE.

mailto:WarnerJ1@state.gov

PART 2: REQUESTED INFORMATION

Respondents are asked to provide the information requested below in accordance with the instructions outlined in Section 1.4 above. Submissions not adhering to the submission instructions may be deemed non-responsive and may receive no further consideration.

2.1 COMPANY INFORMATION

Please provide the following details regarding your organization:

a. Company name.

b. Company point of contact (POC) name.

c. Company POC phone number.

d. Company POC email address.

e. Company URL/web address.

f. Company Cage Code.

g. Company UEI Number.

h. Company federal socioeconomic classification(s), if any, based on North American Industry Classification (NAICS) Code that applies to the proposed solution.

i. List of GSA schedules, Government wide acquisition contracts (GWACs), or other federal IDIQs or contracts the Respondent holds that are accessible by State and where the full proposed solution can be procured, including corresponding schedule number or contract number.

2.2 FUNCTIONAL REQUIREMENTS ASSESSMENT

State’s functional requirements for the solution are outlined below. Respondents are asked to provide a structured response that meets the following format requirements:

a) Response must be structured and annotated to clearly map the detailed description of the proposed solution’s capabilities to the numbered requirements captured in Section 2.2.1 – Section 2.2.5 below. Responses that do not clearly map to the information stated in the listed requirements below or are otherwise unclear regarding where a particular requirement is addressed may be deemed non-responsive and may not receive further consideration.

b) Response narrative content should provide sufficient details regarding the proposed solution’s specific technical capabilities to demonstrate that the solution is capable of fully satisfying each stated requirement. Responses that lack sufficient detail to explain how and to what extent the solution’s capabilities achieve the stated requirement or simply state the solution meets the requirement, may be deemed unresponsive and may not receive further consideration.

2.2.1 Mandatory Qualifications

The following qualifications and capabilities are mandatory requirements for any potential solutions addressing the needs outlined in this notice. Respondents should assess these requirements carefully, as solutions unable to meet these requirements will not be considered as viable options by State and will not receive further consideration:

a. The solution shall be a proven, enterprise-grade COTS product (no custom-built solutions) with demonstrated experience successfully deploying and operating in the federal environment.

b. The solution shall be capable of ingesting logs from applications, databases, systems, networks, and other relevant sources into one or more centralized locations to provide comprehensive visibility across State’s IT environment.

c. The solution shall comply with the following federal standards such as FISMA, NIST SP 800-53, FedRAMP-High, DOD IL5, SOC 2 Type 2, and ISO 27001 and include capabilities that assist State in meeting the logging and retention requirements outlined in OMB Management Directive M-21-31 to include centralized log management, automated reporting, and detailed audit trails.

d. The solution shall support scalability to handle high data ingestion volumes across State’s global operations with the ability to maintain consistent performance under peak loads and support both on-premise and hybrid cloud deployment.

e. The solution shall include advanced analytics capabilities, such as AI/ML driven behavioral analysis and anomaly detection and predictive and cluster analytics, to proactively identify potential threats and operational anomalies across diverse data sources. Behavioral analysis capabilities shall leverage AI/ML-driven automation to support real-time insider threat detection, credential misuse identification, and phishing prevention.

f. The solution shall provide role-based access control mechanisms to ensure data is securely accessed according to user roles and maintain secure data retention policies compliant with Federal regulations and State-specific guidelines.

g. The solution shall comply with State’s Cybersecurity Supply Chain Risk Management (C-SCRM) policy.

o Please review Attachments 1 & 2 and note whether your company can provide the requested information and attestations for your proposed solution.

2.2.2 Enterprise-Wide Log Management and Monitoring

State requires a logging and monitoring solution capable of supporting enterprise-wide operations, including hybrid environments spanning on-premise and multi-cloud architectures. The solution shall provide centralized management and monitoring capabilities with scalability to handle diverse data sources and enable real-time visibility. Key capabilities must include:

a. The solution shall ingest logs from diverse sources including but not limited to application, database, system, and network logs supporting over 300 global locations.

b. The solution shall provide real-time monitoring and alerting of anomalies, system health issues, and cybersecurity incidents. Capabilities shall include adaptive thresholding and automated health diagnostics to enhance the reliability of monitoring activities across the enterprise.

c. The solution shall integrate with third-party platforms, including but not limited to ServiceNow, Okta, and CyberArk to enable automated ticketing, incident management, and streamlined operations. The solution shall provide flexibility to integrate with both current and future tools deployed within State’s IT environment and include capabilities for correlating events and prioritizing alerts based on risk severity.

d. The solution shall centralize telemetry data from sites globally while maintaining low-latency access and processing capabilities.

e. The solution shall support integration with existing departmental Information Technology Service Management (ITSM) systems to facilitate seamless data transfer and operational workflows.

2.2.3 Security Operations and Compliance Analysis

State requires a robust solution to enhance Security Operations Center (SOC) capabilities while ensuring compliance with federal regulations such as FISMA, NIST SP 800-53, and OMB Management Directive M-21-31. The solution shall provide tools for real-time threat detection, incident response, and forensic analysis while automating compliance reporting. Key capabilities must include:

a. The solution shall include Security Information and Event Management (SIEM) functionality to support advanced threat detection and proactive incident response measures.

o The solution shall drastically decrease alerting within the SIEM by correlating singular alerts and applying a risk logic and prioritization that dictates what alerts are displayed to the analysts as actionable.

b. The solution shall automate compliance reporting by providing prebuilt templates, customizable reports, and automated workflows aligned with federal standards including but not limited to FISMA, NIST SP 800-53, and OMB Management Directive M-21-31.

o The solution shall provide detailed audit logs, compliance dashboards, and scheduled reporting capabilities to streamline audit processes and enable efficient review by State’s compliance teams.

c. The solution shall integrate threat intelligence feeds to enhance cybersecurity operations by providing actionable insights for threat detection, mitigation, and response. The solution shall support integration with platforms or tools that enable the sharing and analysis of threat intelligence, facilitating collaboration across stakeholders, and improving situational awareness.

d. The solution shall support configurable role-based dashboards to provide tailored views for executives, SOC analysts, and compliance officers.

e. The solution shall include the ability to generate and distribute compliance reports automatically on a predefined schedule or in response to ad-hoc queries.

f. The solution shall enable advanced behavioral analysis of user activities including but not limited to:

o Machine learning-driven anomaly detection to identify deviations in user behavior.

o Support for insider threat detection policies to enhance organizational security and mitigate potential risks.

o Real-time detection to investigate behavioral anomalies and assess potential security risks.

o Configurable thresholds and rules to tailor behavioral analysis to organizational needs.

g. The solution shall have collaboration tools or shared dashboard capabilities to support cross-agency workflows for compliance reporting, threat intelligence sharing, and incident response. Use of dashboards are configurable to support predictive analytics, risk-based alerting, and guided response actions to ensure efficient resolution of security incidents.

h. The solution shall aggregate and correlate attack surface data to display at-a-glance risk dashboards for devices or system boundaries.

i. The solution shall provide Incident Response (IR) industry standard metrics based on meta data captured from detections and alerting.

2.2.4 Application Performance Monitoring and Analytics

State requires a comprehensive solution to monitor and enhance the performance of mission-critical applications across global operations. The solution shall deliver real-time diagnostics, anomaly detection, and application insights to ensure operational continuity and reliability. To meet State’s requirements, key capabilities include:

a. The solution shall leverage Application Performance Monitoring (APM) tools to analyze and diagnose bottlenecks in application performance.

b. The solution shall provide anomaly detection capabilities to identify patterns or events that deviate from expected application behavior.

Anomaly detection shall incorporate AI-driven insights to identify seasonal patterns and operationalize detection tasks through low-code workflows.

c. The solution shall enable users to create custom dashboards and visualizations of key application performance metrics in real-time. Inclusion of dashboards supports multi-layered customization including dynamic filters, role-specific configurations, and tailored visualizations based on operational needs.

d. The solution shall support multi-application and multi-environment monitoring, including integration with on-premise and hybrid cloud services.

e. The solution shall enable drill-down analysis to identify root causes of performance issues at the transaction, server, or infrastructure level. Root cause analysis leverages probable cause algorithms and predictive models to accelerate diagnostics and remediation.

f. The solution shall include observability capabilities offering a unified view across infrastructure, services, and applications to facilitate real-time monitoring and decision-making.

2.2.5 Data Storage, Licensing, and Cost Efficiency

State requires a solution to efficiently manage data storage and licensing costs, while ensuring scalability to handle projected growth in log ingestion and analytics demands. The solution shall incorporate advanced storage optimization techniques and offer flexible licensing options tailored to operational needs. To meet State’s requirements, key capabilities include:

a. The solution shall de-duplicate, compress, and optimize logs to reduce data storage requirements without impacting accessibility or performance.

b. The solution shall offer flexible licensing models including ingest-based, compute-based, or hybrid approaches to accommodate fluctuating workloads and data volumes while enabling a transparent and cost-efficient pricing model.

c. The solution shall integrate with cloud storage services such as AWS S3, Azure Data Lake, or similar platforms for long-term log retention and analysis.

d. The solution shall include detailed forecasting and management tools to estimate future storage and licensing costs based on anticipated data growth and usage patterns. Tools offer real-time cost monitoring and management capabilities including granular breakdowns of usage and trends by agency, department, or user group.

e. The solution shall provide granular storage management tools, allowing administrators to specify retention policies by data type, source, or sensitivity level. Retention policies must support multi-tiered structures to simultaneously comply with federal and agency-specific guidelines.

f. The solution shall offer de-duplication and compression capabilities that can enable significant cost savings, particularly in large-scale deployments, by minimizing redundant data while preserving critical insights. The solution provides tools for cost monitoring, forecasting, and optimization of storage resources to support efficient scaling across global operations.

g. The solution shall offer ad hoc access to professional services for unforeseen technical support needs.

2.3 PAST PERFORMANCE

State is seeking a solution that has a proven track record in the U.S. federal space with demonstrated experience supporting federal agencies of similar size, global scope, and mission complexity as State. Such experience is critical to ensuring the solution has been proven to be secure and reliable under the required IT security, data management, privacy, and other federal regulations that govern both domestic and overseas information technology implementations within the federal environment.

Please provide the following information regarding your experience deploying your solution for federal customers.

a. Please list the federal agencies where you have successfully deployed your solution in the last three years. For each experience noted, in no more than one paragraph, please provide:

i. Agency and organization name.

ii. Period of performance.

iii. Solutions provided to the agency.

iv. Point of contact name, email, and phone State can contact regarding this experience.

b. For at least one, but not more than three, of the federal implementations provided in bullet (a) above, please provide the additional detailed information requested below to further demonstrate your relevant past experience.

i. Dollar value of contract (across full period of performance).

ii. Period of performance dates.

iii. Schedule, GWAC, or contract used for the requirement.

iv. State whether your company was a prime or subcontractor.

v. Customer point of contact (name, title, email, phone) that State may reach out to for more information.

vi. Description of the scope of the work your company performed and its relevance and applicability to demonstrating your solution’s ability to deliver the full set of capabilities outlined in Section 2.

Disclaimer: This RFI is for information gathering purposes only as a means to identify interested and capable sources that can provide a solution that fully meets all requirements outlined in Part 2 of this request. The information provided in this notice is subject to change and is not binding on the USG. State has not made a commitment to procure any of the items/services discussed, and release of this RFI should not be construed as such a commitment or as authorization to incur cost for which reimbursement would be required or sought.

State will not publicly disclose proprietary information obtained as a result of this RFI. To the full extent that it is protected by law and regulations, information identified by a respondent as Proprietary or Confidential will be kept confidential.

All submissions become USG property and will not be returned.