Network Detection and Response (NDR) Solution

The State of Oregon, through the Department of Administrative Services Procurement Services (DAS PS) on behalf of Enterprise Information Services and Cyber Security Services, is issuing a Request for Proposal (RFP) for a comprehensive Network Detection and Response (NDR) Solution. The procurement seeks a SaaS, IaaS, or COTS solution that includes equipment, configurations, licenses, portals, training, integrations with current security systems, maintenance, and operations support for approximately 90,000 interconnected devices. Key objectives include enhanced network traffic monitoring, anomaly detection, malicious activity identification, and seamless integration with existing security infrastructure like Microsoft Sentinel and Defender XDR. Proposers must demonstrate at least five years of NDR solution experience and have completed at least one similar implementation in the past three years. The evaluation process is multi-phased, with nine initial proposals received and three highest-ranked proposers (Concordant LLC, Vectra.AI, and SHI International Corp.) moving to Round 2, which includes a live demonstration and a Proof of Value (POV) installation scheduled for January 2-3, 2025. Proposals are due by September 6, 2024, with a comprehensive scoring matrix evaluating 2,350 possible points across various technical capabilities.

The RFP encourages participation from certified small businesses, including disadvantaged, minority-owned, women-owned, and veteran-owned firms. Proposers are required to take reasonable steps to ensure Certified Firms have equal opportunities for subcontracting, and must indicate if they are an Oregon certified firm or list certified firms they have worked with in the past two years. The state currently utilizes Tenable for vulnerability management and has a cybersecurity team of approximately 10 people, with 2-3 directly responsible for managing the NDR solution. While specific contract value is not disclosed, the state anticipates awarding a single contract with an initial two-year term and potential renewal options. Proposers must provide a Pay Equity Certificate if they employ 50 or more full-time workers and the contract price exceeds $500,000. The procurement process includes rigorous requirements around insurance, including workers' compensation, professional liability, and commercial general liability coverage. Vendors must also demonstrate compliance with state information technology standards and be prepared for potential contract negotiations following the evaluation process.