Request for Proposal: Secure Services Edge (SSE) Solution

The Oregon Department of Administrative Services, State Procurement Services is requesting proposals for a Secure Services Edge (SSE) solution on behalf of the Enterprise Information Services, with proposals due October 30, 2026 under RFP S-10700-00017534. This is a statewide price agreement supporting approximately 80 executive branch agencies and 40,000 employees, plus cooperative purchasers including cities, counties, and ports.

The scope encompasses Zero Trust Network Access, Secure Web Gateway, Cloud Access Security Broker, Data Loss Prevention, Digital Experience Monitoring, Remote Browser Isolation, Firewall as a Service, DNS Security, and SaaS or API Security, available individually or bundled. The solution must support modular adoption with staggered agency onboarding. The requirements matrix contains 25 mandatory requirements including real-time threat detection, SIEM integration, TLS 1.3 or higher encryption, 99.99% high availability with redundant global data centers, 30-minute RTO and 15-minute RPO disaster recovery, sub-100ms latency for 95% of global users, scalability to 50,000 concurrent users, 24x7x365 support with documented SLAs, and fully documented APIs for infrastructure-as-code integration. Proposers answering "no" to any mandatory requirement face rejection.

The initial contract term is five years with renewal options extending to 15 years total. Pricing must be transparent and menu-based, with separate identification of costs per SSE module, professional services itemized by role and phase, and distinct pricing for government and commercial cloud deployment. The evaluation baseline uses 50,000 users per component for comparison; actual purchase commitments depend on available funding and state needs. Contractors must remit a 2% Vendor Collected Administrative Fee on gross sales and submit quarterly volume reports. Pricing remains firm during the initial five years; adjustments thereafter are limited to 10% annually with 60 days' notice.

Proposers must demonstrate NIST SP 800-53 Moderate level security controls or current GovRAMP Authorization and comply with Oregon's Statewide Information Technology Control Standards (Attachment J), which assess vendor compliance against established security frameworks. All staff with access to state systems must pass fingerprinting, LEDS, and FBI CJIS background checks. Offshore or foreign services require detailed justification. Insurance requirements include Professional Liability (Technology Errors & Omissions) of not less than $2 million per claim, Commercial General Liability of not less than $1 million per occurrence, and Automobile Liability of not less than $1 million combined single limit.

The Proposer Information and Certification Sheet requires attestation of compliance with Oregon tax law, non-discrimination, conflict-of-interest certifications, and sexual harassment and discrimination prevention policies for contracts $150,000 or above. Addendum 1 updated the point of contact email and replaced the Sample Price Agreement; Addendum 2 made available the previously omitted Attachment J (Statewide IT Control Standards). Proposals must remain firm for 180 days following the closing date.