Cyber Asset Attack Surface Management

The Maryland Department of Information Technology is issuing an Invitation to Bid (IFB) number BPM056393 to procure a cloud-hosted Cyber Asset Attack Surface Management (CAASM) platform as a unified system of record for digital asset inventory, vulnerability correlation, and identity mapping across the state's infrastructure. The platform must be commercially available for a minimum of five years and support integration with disparate data streams from on-premises infrastructure, hybrid cloud deployments, and Software-as-a-Service applications. Key deliverables and functional requirements include native multi-tenant architecture with logical data isolation, asset discovery and inventory capabilities that normalize records from multiple authoritative systems and support parsing of physical, virtual, cloud, network, IoT, and OT devices, vulnerability and risk correlation functionality that ingests findings from scanners, EDR, and CSPM tools with configurable risk scoring engines, identity and user visibility capabilities that correlate assets with associated identities and software inventories, integration and interoperability features including RESTful API access and native integration with Microsoft Sentinel, and a minimum of 200 pre-built vendor-supported integrations covering EDR/EPP, IAM/Directory Services, Vulnerability Management, Cloud Infrastructure, SIEM, ITSM/CMDB, MDM, and Network Infrastructure. The platform must also provide agentless asset discovery capabilities through API-based data aggregation and passive network traffic monitoring, advanced reporting and analytics functionality, and support for Maryland's current IT environment of 130,000 unique devices and 280,000 unique user assets with anticipated near-term growth to 150,000 unique devices and 300,000 users. Bidders must submit a completed Requirements Compliance Checklist confirming all functional requirements are met, provide financial statements for the past two years, maintain insurance coverage including $1,000,000 commercial general liability and $1,000,000 workers' compensation, and submit three customer references from SLED customers deployed on the platform for at least twelve months. Questions are due by May 8, 2026, at 10:00 AM EST, with bids due on May 21, 2026, at 10:00 AM EST, and public bid opening scheduled virtually on May 21, 2026, at 10:00 AM EST.

This procurement carries no Minority Business Enterprise (MBE) or Veteran-Owned Small Business Enterprise (VSBE) subcontracting goals, with 0 percent participation goals established, and there is no federal funding associated with this contract. No incumbent vendors or current contractors are identified in the solicitation materials. The contract is structured as a fixed-price engagement with a three-year term and no mentioned renewal options, with the contract award to be made through competitive sealed bidding to the responsible bidder submitting the most favorable bid price. No specific budget range or award value is disclosed in the available solicitation documents. Bidders must comply with Maryland state registration and tax payment requirements, and the primary place of performance is the Department of Information Technology, with the successful contractor responsible for the platform's underlying infrastructure, maintenance, and patching. Vendors must acknowledge Amendment #1 to the IFB in accordance with COMAR 21.05.02.08A regulations, and only a single bid per offeror is permitted with no multiple or alternative bids allowed.