Request for Proposal Number M15-RFP-003 for Vulnerability Assessment and Discovery Tool by the Washington State Consolidated Technology Services Released July 8, 2014 i
Table of Contents 1. INTRODUCTION... 1 1.1 Background... 1 1.2 Acquisition Authority... 1 1.3 Business Objective... 1 1.4 Contract Term... 2 1.5 Definitions... 2 1.6 Overview of Solicitation Process... 2 1.7 Funding... 3 2. SCHEDULE... 4 3. INSTRUCTIONS TO RESPONDING VENDORS... 5 3.1 RFP Coordinator (Proper Communication)... 5 3.2 Vendor Questions... 5 3.3 Vendor Complaints Regarding Requirements and Specifications... 5 3.4 Response Contents... 5 3.5 Response Requirements... 6 3.6 Delivery of Responses... 6 3.7 Proprietary or Confidential Information... 6 3.8 Waive Minor Administrative Irregularities... 7 3.9 Errors in Response... 7 3.10 Administrative Clarifications... 7 3.11 Amendments/Addenda... 7 3.12 Right to Cancel... 7 3.13 Contract Requirements... 7 3.14 Incorporation of Documents into Contract... 8 3.15 Minority and Women s Business Enterprises (MWBE)... 8 3.16 No Obligation to Contract/Buy... 8 3.17 Non-Endorsement and Publicity... 8 3.18 Optional Vendor Debriefing... 8 3.19 Protest Procedures... 9 3.20 Vendor Assumption and Dependencies... 9 3.21 Selection of Apparently Successful Vendor... 9 3.22 Additional Products and Services... 9 4. VENDOR REQUIREMENTS... 10 4.1 (M) Vendor Profile(s)... 10 4.2 (M) Vendor Licensed to do Business in Washington... 10 4.3 (M) Vendor Requirements... 10 4.4 (M) Use of Subcontractors... 10 4.5 (M) Prior Contract Performance... 10 4.6 (M) Vendor Organizational Capabilities... 11 5. PHASE 1- (1825) TECHNICAL REQUIREMENTS... 12 5.1 (MS/DS 850) Core Functions... 12 ii
5.2 (DS 300) Target Recognition... 13 5.3 (MS/DS 475) Reporting / Compliance / Remediation... 13 5.4 (M) Software Ownership... 14 5.5 (MS 50) System training, pre-installation and post installation... 14 5.6 (MS 150) Maintenance and Operations... 14 5.7 (M) Vendor Replacement of Defective Shipments... 15 5.8 (M) Product Delivery... 15 PHASE II- (1175) PRODUCT PRESENTATIONS, DEMONSTRATIONS, AND REFERENCE CHECKING (OPTIONAL AT CTS DISCRETION).... 15 5.9 (DS 300) Demonstration - Overall Usability... 15 5.10 (DS 800) Demonstration - Features... 15 5.11 (DS 75) Client References... 16 6. FINANCIAL QUOTE... 18 6.1 Overview... 18 6.2 (MS 125) Vendor Cost Proposal Form... 18 6.3 (M) Price List... 18 6.4 (M) Cost Model... 18 6.5 (M) Responses... 18 6.6 (M) Taxes... 19 6.7 (M) Presentation of All Cost Components... 19 6.8 (M) Price Protection... 19 7. EVALUATION... 20 7.1 Overview... 20 7.2 Administrative Screening... 20 7.3 Mandatory Requirements... 20 7.4 Qualitative Review and Scoring... 20 7.5 EVALUATION PHASE I: Section 5 Evaluation... 20 7.6 Section 5 Phase 1 Evaluation... 21 7.7 Financial Scores... 21 7.8 EVALUATION OPTIONAL PHASE II: Section 6 Evaluation (Reference Checks and Product Demonstrations)... 22 7.9 OPTIONAL PHASE 2 Client Reference Evaluation... 23 7.10 OPTIONAL PHASE 2 Demonstration Evaluation... 23 7.11 Allocation of Points... 23 7.12 Vendor Total Score... 23 7.13 Selection of Apparently Successful Vendor... 24 7.14 Contract Negotiations... 24 APPENDIX A... 1 APPENDIX B... 2 APPENDIX C... 1 APPENDIX D... 1 APPENDIX E... 2 iii
APPENDIX F... 7 APPENDIX G... 8 iv
1. INTRODUCTION SECTION 1 Responding Vendors are strongly encouraged to read this RFP thoroughly and completely. 1.1 Background Consolidated Technology Services (CTS) provides telecommunications, computing and digital government services to more than 700 state agencies, boards and commissions, local governments, tribal organizations and qualifying non-profits. CTS operates a secure, statewide standards-based telecommunications network providing reliable, economical voice, data and video communications. CTS operates two data centers in Olympia Washington. The State Data Center is one of the largest in the Northwest, combining both client server and mainframe computing in a secure, controlled environment. For more information, visit the CTS Web site at www.cts.wa.gov. CTS issues this RFP to purchase vulnerability assessment and discovery tool equipment, software and services. 1.2 Acquisition Authority The Department of Enterprise Services (DES) has authority over goods and services under RCW 39.26 and sets processes for procuring information technology based on the policies and standards set by the Technology Services Board. Chapter 43.41A of the Revised Code of Washington (RCW) as amended establishes the Washington State Technology Services Board (TSB). While the TSB does not purchase for agencies, it establishes policies and standards addressing the manner in which state agencies may acquire information technology equipment, software, and services. RCW 39.26.100(2) provides CTS with an exemption from the Department of Enterprise Services procurement rules and requirements. Specifically, the competitive procurement rules stated by Department of Enterprise Services do not apply to CTS if it is contracting for the following: 1. Services and activities that are necessary to establish, operate, or manage the state data center, including architecture, design, engineering, installation, and operation of the facility, that are approved by the technology services board or 2. The acquisition of proprietary software, equipment, or IT services for or part of the provision of services offered by the consolidated technology services agency. This procurement is within the exemption and is performed consistent with CTS internal Exempt Procurement Policy. This RFP is issued in good faith but it does not guarantee an award of contract, nor does it represent any commitment to purchase whatsoever. 1.3 Business Objective CTS is initiating this Request for Proposals (RFP) to provide: (a) Products and Services required to install and deploy Vulnerability Assessment and discovery technology within the CTS data center network infrastructure as a multi-tenant enterprise service provider; and (b) associated software, licenses, installation services, maintenance, onsite support, training and upgrades. 1
1.4 Contract Term It is anticipated that the Initial Term of the resulting Contract will be through July 1, 2016 commencing on the effective date of the Contract. CTS, at its sole discretion, may initiate extending the Contract for up to five additional years. CTS may commit to maintenance purchases for multiple years, but payments cannot be made in advance, and will be paid on an annual basis. 1.5 Definitions Business Days or Business Hours shall mean Monday through Friday, 8 AM to 5 PM, local time in Olympia, Washington, excluding Washington State holidays. Contract shall mean the RFP, the Response, Contract document, all schedules and exhibits, and all amendments awarded pursuant to this RFP. CTS shall mean Consolidated Technology Services. Desirable Scored or DS shall mean that answering is optional, and the Response will be scored. Mandatory or (M) shall mean the Vendor must comply with the requirement, and the Response will be evaluated on a pass/fail basis. Mandatory Scored or (MS) shall mean the Vendor must comply with the requirement, and the Response will be scored. Response shall mean the written proposal submitted by Vendor to CTS in accordance with this RFP. The Response shall include all written material submitted by Vendor as of the date set forth in the RFP schedule or as further requested by CTS. The Response shall be in the English language, and all measurements and qualities will be stated in units required by law in the United States. Solution shall mean a product, combination of products, services, or a mix of products and services that an original equipment manufacturer, vendor, service provider or value added reseller offers to customers to address a specific business problem or scenario. Vendor shall mean the company, organization, or entity submitting a Response to this RFPQ, its subcontractors and affiliates. 1.6 Overview of Solicitation Process The evaluation process applies successive rounds of evaluation that will narrow the pool of competitors to assure only the highest scoring finalists move to the next Round in the evaluation process. CTS, at its sole discretion, will determine the number of top scoring competitors to move to the next Round. Round 1: A preliminary examination of the completeness and validity of responses. All responsive Vendors will move to Round 2. Round 2: A technical evaluation to determine compliance with requirements and financial review. Only the top scoring Vendors will move to Round 3. CTS, at its sole discretion, will determine the number of top scoring competitors to move to the next Round. Round 3: Reference checks and scored demonstration. References will be checked to ascertain Vendor s performance in prior engagements, and to determine the similarities and scope of prior engagements in contrast with this effort. 2
The financial review will look at commercial risk and cost analysis of all pricing, project schedules, terms and conditions contained within the Response. CTS, at its sole discretion, will determine the number of top scoring competitors to move to the next Round. Round 4: Announce Apparently Successful Vendor(s). Award of contract. After completing the evaluation using the process as set forth above, CTS may move to enter into contractual negotiations with one Apparently Successful Vendors (ASVs) with a view to finalizing a contract. Award of contract will depend on a satisfactory outcome to these negotiations. 1.7 Funding Any contract awarded as a result of this procurement is contingent upon the availability of funding. 3
SECTION 2 2. SCHEDULE This RFP is being issued under the following Schedule. The Response deadlines are mandatory and non-negotiable. Failure to meet any of the required deadlines will result in disqualification from participation. All times are local time, Olympia, WA. DATE & TIME EVENT July 8, 2014 July 14, 2014 July 16, 2014 August 1, 2014 August 4-7, 2014 August 8-13, 2014 August 15, 2014 August 18 2014 August 19-20, 2014 RFP Issued Final Vendor Questions and Comments due by 12 Noon State s Final Written Answers issued Responses due by 12 Noon Evaluation period Phase 2 Demonstrations Announcement of ASV Vendor Request for Optional Debriefing due Optional Vendor Debriefings CTS reserves the right to revise the above schedule. 4
SECTION 3 3. INSTRUCTIONS TO RESPONDING VENDORS RFP Coordinator (Proper Communication) All communications relevant to this RFP must be addressed in writing to the RFP Coordinator at the contact information below: Contact Name: E-mail Address: Michael Callahan Phone: 360-407-8765 michael.callahan@cts.wa.gov All oral communications will be considered unofficial and non-binding on the State. Any other direct or indirect communication with employees or (sub) contractors of our organization regarding this RFP will be treated as misconduct and may result in your response being disqualified. 3.2 Vendor Questions It is the Vendor s responsibility to remedy any ambiguity, inconsistency, error or omission within this document before submitting their Response. Vendors shall submit all requests to the contact above no later than noon on the closing date stated in Section 2. An official written CTS response will be provided for Vendor questions received by this deadline. Written responses to Vendor questions will be posted on the CTS web site at: www.cts.wa.gov 3.3 Vendor Complaints Regarding Requirements and Specifications Vendors may submit specific complaints in writing to the RFP Coordinator, if Vendor believes requirements exist that unduly constrain competition. The complaint must be made in writing to the RFP Coordinator before the Response due date. The complaint must state how the requirement unduly constrains competition and provide the relevant facts, circumstances and documentation. The solicitation process may continue. 3.4 Response Contents The Response must contain information responding to all mandatory requirements, a signed certification and assurances, and must include the signature of an authorized Vendor representative on all documents required in the appendices. The Response should be submitted in two (2) separate files containing what is listed below. This separation of documentation protects the integrity of the State s evaluation process. No mention of the cost response may be made in Volume 1. File entitled --Volume 1: Vendor s cover letter explicitly acknowledging receipt of all RFP revisions issued, if any; and The Response to Section 4, Vendor Requirements and Section 5, Technical Requirements File entitled--- Volume 2: The Responses to Section 6, Financial Quote The cost response in a completed Cost Model Vendor s signed and completed Certifications and Assurances 5
Vendor s exceptions and/or proposed revisions to the Contract Vendor s MWBE Certification (Appendix C), if applicable Failure to provide any requested information in the prescribed format may result in disqualification of the Vendor. 3.5 Response Requirements The signature block in Appendix A, Certifications and Assurances, must be signed by a representative authorized to bind the company to the offer. For Mandatory requirements (M), the Response must always indicate explicitly whether or not the Vendor s proposed Products/Services meet the requirement. A statement, (Vendor Name) has read, understands, and fully complies with this requirement is acceptable, along with any additional information requested. For Mandatory Scored (MS) and Desirable Scored (DS) items, the Response must always indicate explicitly whether or not the Vendor's proposed Products/Services meet the requirement, and describe how the proposed Vendor s Products/Services will accomplish each requirement or desirable as it relates to the service(s) proposed. Vendor must respond to each Requirement, unless it is a Desirable or Desirable Scored requirement. Failure to comply with any applicable item may result in the Response being disqualified. In each requirement title is a designation indicating how the Response will be evaluated,. 3.6 Delivery of Responses All proposals must arrive via an attachment to e-mail to the RFP Coordinator at the email address above, on the proposal due date and time stated in Section 2. Responses arriving in in the RFP Coordinator s in-box after the time stated in Section 2 will be disqualified. The "receive date/time" posted by CTS email system will be used as the official time stamp but may not reflect the exact time received. Vendors should allow sufficient time to ensure timely receipt of the proposal by the RFP Coordinator. Late Responses will not be accepted and will be automatically disqualified from further consideration. CTS assumes no responsibility for delays caused by Vendor s e-mail, network problems or any other party. Zipped files cannot be received by CTS and cannot be used for submission of Responses. 3.7 Proprietary or Confidential Information Any information contained in the Response that is proprietary or confidential must be clearly designated. Marking of the entire Response or entire sections of the Response as proprietary or confidential will not be accepted nor honored. CTS will not accept Responses where pricing is marked proprietary or confidential, and the Response will be rejected. To the extent consistent with chapter 42.56 RCW, the Public Disclosure Act, CTS shall maintain the confidentiality of Vendor s information marked confidential or proprietary. If a request is made to view Vendor s proprietary information, CTS will notify Vendor of the request and of the date that the records will be released to the requester unless Vendor obtains a court order enjoining that disclosure. If Vendor fails to obtain the court order enjoining disclosure, CTS will release the requested information on the date specified. 6
The State s sole responsibility shall be limited to maintaining the above data in a secure area and to notify Vendor of any request(s) for disclosure for so long as CTS retains Vendor s information in CTS records. Failure to so label such materials or failure to timely respond after notice of request for public disclosure has been given shall be deemed a waiver by Vendor of any claim that such materials are exempt from disclosure. 3.8 Waive Minor Administrative Irregularities CTS reserves the right to waive minor administrative irregularities contained in any Response. Additionally, CTS reserves the right, at its sole option, to make corrections to Vendors Responses when an obvious arithmetical error has been made in the price quotation. 3.9 Errors in Response Vendors are liable for all errors or omissions contained in their Responses. Vendors will not be allowed to alter Response documents after the deadline for Response submission. CTS is not liable for any errors in Responses. 3.10 Administrative Clarifications CTS reserves the right to contact Vendor for clarification of Response contents. 3.11 Amendments/Addenda CTS reserves the right to change the Schedule or other portions of this RFP at any time. Any changes or corrections will be by one or more written amendment(s), dated, and attached to or incorporated in and made a part of this solicitation document. If there is any conflict between amendments, or between an amendment and the RFP, whichever document was issued last in time shall be controlling. 3.12 Right to Cancel With respect to all or part of this RFP, CTS reserves the right to cancel or reissue at any time without obligation or liability. 3.13 Contract Requirements To be responsive, Vendors must indicate a willingness to enter into a Contract substantially the same as the Contract in Appendix B, by signing the Certifications and Assurances located in Appendix A. Any specific areas of dispute with the attached terms and conditions must be identified in the Response and may, at the sole discretion of CTS, be grounds for disqualification from further consideration in the award of a Contract. Vendor must explain why each item proposed as additional contract terms is in CTS best interest as a customer and how it will support CTS business objectives. Under no circumstances is a Vendor to submit their own standard contract terms and conditions as a response to this solicitation. Instead, Vendor must review and identify the language in Appendix B that Vendor finds problematic, state the issue, and propose the language or contract modification Vendor is requesting. CTS expects the final Contract signed by the ASV to be substantially the same as the contract located in Appendix B. 7
If Responses are from a Reseller, wherever the suppliers offers selected customers more suitable terms and conditions of supply, Vendors shall recommend these terms and help CTS to obtain them wherever possible. Where terms and conditions cannot be changed and may have negative consequences on the quality of goods and services or their supply, Vendors are required to recommend methods of mitigating or limiting these negative consequences. The final contract executed by the parties must satisfy CTS s obligations with respect to performance-based contracting as directed in Executive Order 10-07. The parties may negotiate performance-based elements, in addition to those in Appendix B, for inclusion into the final contract. The foregoing should not be interpreted to prohibit either party from proposing additional contract terms and conditions during negotiation of the final Contract. The ASV will be expected to execute the Contract within ten (10) Business Days of its receipt of the final Contract. If the selected Vendor fails to sign the Contract within the allotted ten (10) days time frame, CTS may elect to cancel the award, and award the Contract to the next ranked Vendor, or cancel or reissue this solicitation. 3.14 Incorporation of Documents into Contract This solicitation document and the Response will be incorporated into any resulting Contract. 3.15 Minority and Women s Business Enterprises (MWBE) CTS strongly encourages participation of minority and women s businesses. Vendors who are MWBE certified or intend on using MWBE certified Subcontractors are encouraged to identify the participating firm on Appendix C. No minimum level of MWBE participation is required as a condition of receiving an award and no preference will be included in the evaluation of Responses in accordance with chapter 39 RCW. For questions regarding the above, contact Office of MWBE at (360) 753-9693. 3.16 No Obligation to Contract/Buy CTS reserves the right to refrain from Contracting with any and all Vendors. Neither the release of this solicitation document nor the execution of a resulting Contract obligates CTS to make any purchases. CTS reserves the right to cancel the procurement at any time during the procurement or resulting contract negotiation process. 3.17 Non-Endorsement and Publicity In selecting a Vendor to supply Services to the state of Washington, the State is neither endorsing Vendor s Products, nor suggesting that they are the best or only solution to the State s needs. By submitting a Response, Vendor agrees to make no reference to CTS or the state of Washington in any literature, promotional material, brochures, sales presentation or the like, regardless of method of distribution, without the prior review and express written consent of CTS. 3.18 Optional Vendor Debriefing Only Vendors who submit a response may request an optional debriefing conference to discuss the evaluation of their Response. The requested debriefing conference must occur on or before the date specified in the Schedule (Section 2). The request must be in writing (fax or e-mail acceptable) addressed to the RFP Coordinator. 8
The optional debriefing will not include any comparison between the Response and any other Responses submitted. However, CTS will discuss the factors considered in the evaluation of the requesting the Response and address questions and concerns about Vendor s performance with regard to the solicitation requirements. 3.19 Protest Procedures Vendors who have submitted a Response to this solicitation and have had a debriefing conference may make protests. Upon completion of the debriefing conference, a Vendor is allowed five (5) Business Days to file a formal protest of the solicitation with the RFP Coordinator. Further information regarding the grounds for, filing and resolution of protests is contained in Appendix D, Protest Procedures. 3.20 Vendor Assumption and Dependencies CTS will rely upon representations made in the Response. If the Vendor chooses to identify assumption or dependencies on which it has based its proposal, CTS retains the right to determine if the Vendor s assumptions/dependencies render the Response non-responsive. 3.21 Selection of Apparently Successful Vendor All Vendors responding to this solicitation will be notified by mail or e-mail when CTS has determined the ASV. The ASV will be the respondent who: (1) meets all the requirements of this RFP; and (2) receives the highest number of total points as described herein. 3.22 Additional Products and Services Additional Products or Services that are determined by CTS to be appropriate to the scope of this acquisition may be added to the Contract. 9
SECTION 4 4. VENDOR REQUIREMENTS 4.1 (M) Vendor Profile(s) The following detail about the Vendor s organization is required to ensure that it can meet CTS requirements. The Vendor working on its behalf shall each provide the following information: 1. The legal entity for example, a private or public corporation together with its name and registered address. 2. The total number of years the legal entity has been in business and, if appropriate, the number of years under the present business name. 3. Website URL 4.2 (M) Vendor Licensed to do Business in Washington Within thirty (30) days of being identified as the ASV, Vendor must be licensed to conduct business in Washington, including registering with the Washington State Department of Revenue. The Vendor must collect and report all applicable taxes. The Vendor must submit Vendor s Unified Business Identification (UBI) number within 30 days of being identified as the ASV. 4.3 (M) Vendor Requirements Vendors who are not the manufacturers of the proposed product must be authorized and well trained or certified in the product. Vendor must have well qualified and certified networking technical staff available to install, support, trouble shoot the product. Vendors must submit as an attachment to their response any certifications and status as an authorized reseller for a manufacturer product, including either: 1) a copy of the Reseller Agreement and 2) a certificate or letter from the Manufacturer stating the Vendor's compliance with this requirement. In the event the responding vendor is the Manufacturer, a statement to that end is a sufficient. 4.4 (M) Use of Subcontractors CTS will accept Responses that include third party involvement only if the Vendor submitting the Response agrees to take complete responsibility for all actions of such Subcontractors. Vendors must state whether Subcontractors are/are not being used, and if they are being used, Vendor must list them in response to this subsection. CTS reserves the right to approve or reject any and all Subcontractors that Vendor proposes. Any Subcontractors engaged after award of the Contract must be pre-approved, in writing, by CTS. Any subcontractor used to physically interact with IT equipment where there is a requirement for certification to move said equipment, must also be certified by the equipment manufacturer. All subcontractors must complete a Criminal Background check as outlined in section 4.3. Specific restrictions apply to contracting with current or former state employees pursuant to chapter 42.52 RCW. Vendors should familiarize themselves with the requirements prior to submitting a Response. 4.5 (M) Prior Contract Performance Vendor must submit full details of all Terminations for Default for performance similar to the Software/Services requested by this RFP experienced by the Vendor in the past five (5) years, 10
including the other party s name, address and telephone number. If the Vendor has experienced no such Terminations for Default in the past five years, they must so declare. If the Vendor has been suspended or debarred by the Department of Enterprise Services, they must so declare and provide details surrounding the suspension/debarment. CTS will evaluate the information and may, at its sole discretion, reject the Response if the information indicates that completion of a Contract resulting from this RFP may be jeopardized by selection of the Vendor. 4.6 (M) Vendor Organizational Capabilities Vendor must provide a brief description of its entity (including business locations, size, areas of specialization and expertise, client base and any other pertinent information that would aid an evaluator in formulating a determination about the stability and strength of the entity), including the Vendor organization s experience and history with Vulnerability Assessment solutions. 11
SECTION 5 5. PHASE 1- (1825) TECHNICAL REQUIREMENTS Respond to the following requirements per the instructions in Section 3. Additionally, please remember that for Mandatory (M), and Mandatory scored requirements (MS), always indicate explicitly whether or not the proposed solution meets the requirement. Explain how your product will meet or exceed all technical requirements listed below. 5.1 (MS/DS 850) Core Functions 5.1.1 (M) Solution must be capable of supporting the vulnerability assessment needs and asset discovery needs of the entire State of Washington public sector. (500,000-1,000,000 IP's, several thousand web applications, hundreds of agency/tenants) 5.1.2 (M) Solution must be a turnkey system. CTS anticipates a turnkey system requires some configuration specific to the implementation, it does not anticipate complex development work. The level of customization should be addressed in the Vendor s Response. 5.1.3 (M) Solution must be currently manufactured and available for general sale, lease, or license on the date the proposal is submitted. It must also have a similar implementation and deployment with 2 or more of your customers and be running or have run in a similarly sized multi-tenant infrastructure network for a minimum of 6 months. 5.1.4 (M) Solution must have an appliance / virtual appliance based scanning device for deployment throughout the state's wide area network and provide the ability to have agentless scans sourced from both Internet and Intranet network segments. 5.1.5 (M) Solution must support customizable scanning profiles or templates per multi-tenant customer. 5.1.6 (M) Solution must support recurring scheduled scans and the ability for scans to be paused and resumed if they are not completed during a pre-defined maintenance scan window. 5.1.7 (M) Solution must identify and relate vulnerabilities found to industry standard libraries of vulnerabilities and their remediation. 5.1.8 (M) Solution must meet OCIO Security Standards. http://www.ocio.wa.gov/policies/141- securing-information-technology-assets/14110-securing-information-technology-assets 5.1.9 (MS 150) Describe in detail the solution's multi-tenancy architecture and design. Include physical and logical diagrams, number of servers, server specifications, storage for one year of historical data, etc. for 3 multi-tenant customers at 3 different sites, with a total capacity of 500,000 IP's and 30 web applications. Include details of 802.1q support, routing, and an on-premise only option. Solution must have a multi-tenant architecture that is scalable and not overly complex. 5.1.10 (MS 150) Describe in detail the solution's multi-tenancy functions. This should address a service provider/tenant model. Include details of centralized management; delegated administration; identity management, logging, etc. Solution must support multi-tenancy functions that meet the needs of the State of Washington so that tenant data is segmented from one another and so that the service provider can view all tenants. 12
5.1.11 (MS 75) Describe the solution s application-layer/web application vulnerability assessment capability. Solution must be able to perform web application scanning. 5.1.12 (MS 75) Describe how the solution s technology fingerprints devices on the network and what information is captured. Also indicate the solution's passive monitoring capabilities and if the discovery process can identify devices in real-time. The solution must be capable of asset discovery and management of those assets by user-defined groups. 5.1.13 (MS 50) Describe the solution's capability to perform authenticated scans of applications/ databases/operating systems. Solution must support device and web application authenticated scans. 5.1.14 (MS 50) Describe the solution's ability to have the database keep track of historical scan information for an asset. Indicate how hosts with frequently changing IP s are handled as well as multiple tenants with the same private IP space. Solution must have the ability to track historical scan information on an asset and have tenants with the same private IP space retain tenant data segregation. 5.1.15 (MS 25) Describe how the solution updates vulnerability signatures and scanning engines. Indicate the frequency of signature updates. Solution must provide vulnerability signature updates every two weeks at a minimum with an out of cycle emergency process in place for high impact vulnerabilities. 5.1.16 (MS 25) Describe the solution's encryption strategy, and indicate specifics around data in transit and data at rest. Solution must have the ability to encrypt sensitive data. 5.1.17 (DS 100) Describe the solution s third-party integration capabilities. Examples: Ticketing systems, and other security solutions. 5.1.18 (DS 50) Describe the solution's capability to perform a configuration assessment. 5.1.19 (DS 25) Describe the solution s tolerance for failures/outages in critical system components. 5.1.20 (DS 25) Describe the solution's capability to create new security configuration policies, modify custom policies, and modify predefined policies. Indicate how/if a customer's policies and standards can be transitioned into your solution. 5.1.21 (DS 25) Briefly describe the solution's release management process. 5.1.22 (DS 25) Briefly describe the solution s roadmap for the next two years. 5.2 (DS 300) Target Recognition 5.2.1 (DS 100) Provide a list of devices that are recognized by the solution. 5.2.2 (DS 100) Provide a list of all applications and tools that are recognized by your solution. 5.2.3 (DS 50) Provide a list of DBMSs/databases recognized by the solution. 5.2.4 (DS 50) Indicate capabilities for scanning virtual environments with the solution. Indicate management plane, virtual images, cloud applications, cloud infrastructure, other capabilities, etc. 5.3 (MS/DS 475) Reporting / Compliance / Remediation 5.3.1 (M) Solution must support PCI compliance reporting. 5.3.2 (MS 150) Describe the solution's canned report capability. Include the following report examples: Executive, trending, vulnerability by vulnerability, vulnerability by asset, 13
asset inventory, remediation ( how to fix ), control standard, and a baseline comparison. Solution must provide canned common reports similar to the above examples. 5.3.3 (MS 100) Describe the solution's ability to customize reports. Provide five examples. Solution must provide the ability to customize reports and add exceptions for specific vulnerabilities. 5.3.4 (DS 125) Describe the solution's additional compliance reporting capabilities. Examples: PCI, HIPAA, Pub 1075, FISMA, etc. 5.3.5 (DS 100) Provide an example of an enterprise report that lists the top prioritized vulnerabilities, also provide an example of the report from the tenant perspective. 5.4 (M) Software Ownership Vendor s Response must include a statement indicating whether the software is owned by manufacturer or a third party Vendor. If the Vendor is not the owner of the software, Vendor and the Software Owner must agree to the following (please indicate whether Vendor understands and agrees to each failure to do so shall result in disqualification from bidding on this RFP): a) Vendor must identify the software owner and provide contact information; and b) Vendor must provide the software owner s licensing terms; and c) Vendor must provide CTS terms and conditions to software owner; and d) Software owner must agree to participate in contract negotiations with CTS. 5.5 (MS 50) System training, pre-installation and post installation 5.5.1 (MS 25) Vendor must provide installation and pre-installation services setup, configuration assistance and knowledge transfer. Please provide a sample Statement of Work reflecting these tasks. 5.5.2 (MS 25) Vendor must provide post-installation tailored formal training in-house for a minimum of 8 hours, on three separate occasions (to account for all shift members). Training should include hands on training specific to vendor equipment and how it will interface with CTS equipment and installed base as well as training for Vulnerability Assessment root level administration audience and Vulnerability Assessment delegated administration audience. Please provide a sample training plan. 5.6 (MS 150) Maintenance and Operations 5.6.1 (M) Vendor must have a robust on-line knowledgebase for this product. 5.6.2 (MS 100) Vendor shall provide 24x7x365 customer support level 1, 2 and 3 through manufacturer or fully trained and qualified vendors technicians, with a high degree of preference for direct support with manufacturer. Technical support and troubleshooting of equipment may require immediate attention and less than 24 hour response times for support requests. Phone support is preferable. Describe the product support structure in detail, including support options such as 8x5/24x7. Also include response times and escalation procedures. 5.6.3 (MS 25) Vendor shall replace hardware and parts within the time frames in the support agreement. Describe how replacements are handled and the escalation procedure. 5.6.4 (MS 25) Vendor shall provide software upgrades with a maintenance support contract. Provide a copy of the maintenance support. 14
5.7 (M) Vendor Replacement of Defective Shipments Vendor must replace Product shipments found to be defective by Customer within five (5) Business Days notification by CTS. 5.8 (M) Product Delivery Delivery of Products must occur within twenty one (21) Business Days of Vendor s receipt of order. If delivery exceeds twenty one (21) Business Days, Vendor must have Manufacture certify in writing that there is no Product available through any channel source because of Product constraints. Elapsed delivery time will be measured from the time an order is accepted, either verbally or in writing by Vendor, to the time product is delivered to CTS, Olympia, Washington, or alternative delivery Customer site within Washington State at CTS discretion. PHASE II- (1175) Product Presentations, Demonstrations, and Reference Checking (Optional at CTS Discretion). CTS, at its sole discretion, may elect to select one or more of the five top scoring finalist(s) for product presentation, product demonstrations, and reference checking as part of the evaluation process. The purpose of Optional Section 5 Phase II, if selected by CTS to pursue, is to provide the State the ability to validate usability of the product for an enterprise class multi-tenant service, as well as score Desirable Requirements. Invited Vendors will be required to provide CTS with a presentation and demonstration to show the requirements in Optional Section 5 Phase II. Presentation and Demonstrations will be scored based on usability (Section 5.9) and capability (Section 5.10) of the Desirable Scored requirements within this RFP. Finalists may also be required to respond to additional criteria discovered as a result of the Phase I submissions as they relate to function and suitability of the Mandatory Requirements. All vendors must provide Reference information as outlined in Section 5.11 Client References. All vendors must indicate availability for Product Presentations and Demonstrations. The total time for product presentation combined with product demonstration is not to exceed 3 hours. The recommended schedule would include 60 minutes for the product presentation, high level requirement coverage and Q & A, and 90 minutes for the demonstration. 5.9 (DS 300) Demonstration - Overall Usability During the presentation and demonstration CTS will evaluate the solution s overall usability for the following categories: 5.9.1 (DS 100) Service Provider Administrator usability. 5.9.2 (DS 100) Tenant Administrator usability. 5.9.3 (DS 100) Reporting usability. 5.10 (DS 800) Demonstration - Features CTS, at its sole option, may require Vendor Presentations and Software Demonstrations. If CTS elects to conduct Vendor Software Demonstrations, one or more of the the top five highest scoring Vendors from Rounds 1-4 will be asked to conduct an on-site (at CTS facility located at 1500 Jefferson St. SE, Olympia, WA 98504) presentation and demonstration of their proposed software solution during the time period identified in RFP Timeline (Section 2). If Round 5 15
demonstrations are held, the RFP Coordinator will contact the Vendors to schedule and coordinate demonstrations. CTS will make good faith efforts to provide needed resources (e.g., internet access, telephone line, projection screen or other special accommodations), but cannot guarantee their availability. The Vendors should be ready to inform CTS of their special communication or presentation requirements upon notification that they have been selected as a Round 5 participant. Representations made by the Vendor during the oral presentation and product demonstration will be considered binding. The presentation portion will give the vendor the opportunity to summarize their proposal to CTS and answer specific questions the evaluation team may have. Demonstrations should be scripted and highlight of functionality of the solution. Detailed information regarding the presentation & demonstration will be provided to the primary contact identified in the Vendor s response upon notification to participate. Please indicate your firm s availability to participate per the Schedule 2 timeline. 5.10.1 (DS 200) Demonstrate the solution's reporting and dashboard capabilities. Indicate the ability to distinguish what the single most critical vulnerability is in an environment. 5.10.2 (DS 100) Demonstrate how multi-tenancy is configured, tenant setup, how the tenant is isolated so their data is not viewable by other tenants, as well as allow for a service provider view of all tenants. 5.10.3 (DS 100) Demonstrate how the solution can fingerprint an asset and identify services running, products, software versions supporting the services on both standard and nonstandard ports, and vulnerabilities associated to those services. Indicate the solution's capability to produce network topology discovery and diagrams/maps. 5.10.4 (DS 75) Demonstrate the solution's capability to organize assets and utilize Asset Groups. 5.10.5 (DS 75) Demonstrate any additional features, capabilities, or core competencies that were not previously covered in the RFP questions. 5.10.6 (DS 50) Demonstrate the solution's ability to schedule and customize scans. 5.10.7 (DS 50) Demonstrate the solution's ability to perform custom vulnerability checks. 5.10.8 (DS 50) Demonstrate the solution's capability to detect software, and/or perform a software inventory. 5.10.9 (DS 50) Demonstrate the ability to perform an application scan and its configuration options. 5.10.10 (DS 25) Demonstrate the authentication options for your solution's various components. Indicate if multi-factor authentication is supported. 5.10.11 (DS 25) Demonstrate the solution's ability to retain historical scan information. 5.11 (DS 75) Client References Vendors shall provide as references the names, addresses, telephone numbers, e-mail addresses, and contact person for a minimum of three (3) representative customers. References must be for projects that are of a similar size and scope of the project anticipated in this RFP. References will be asked questions on the reference form attached as Appendix G. Reference scores will be used as part of the response evaluation process as described in Section 7, Evaluation. The Hardware, Software, and Services purchased by these clients should be similar to those requested by this RFP. 16
References must not be from a person, company or organization with any special interest, financial or otherwise, in the Vendor. When requested by CTS, reference contact information must be provided, however, CTS at its sole discretion may elect to check references for only top scoring finalists, up to three (3). CTS reserves the right if one of those three (3) Vendors receives a negative reference, to disqualify that Vendor and move to the next top scoring Vendor. CTS reserves the right to eliminate from further consideration, in the RFP process, any Vendor who, in the opinion of CTS, receives an unfavorable report from a reference. CTS may, at its discretion, contact other Vendor clients for references. CTS will use a Client Reference Form to check references. To the extent a Response may give rise to confidentiality obligations, CTS will not sign an NDA to receive the information. Instead, please respond with sufficient information to enable CTS to evaluate and contact the Client Reference. In the event that one of the provided references is a member of the evaluation team, CTS will contact the Vendor for an alternate reference. The alternate reference shall be provided timely and must be available during the evaluation period. CTS will make one (1) attempt to contact the client and obtain a reference, CTS will leave voicemail and it is acceptable if a return call is received within the timeframe set forth in Schedule Section 2. If a contact cannot be made, the reference will be disallowed. It is the Vendor s responsibility to provide CTS with references that will be timely and available during the evaluation period set forth in Schedule Section 2. CTS reserves the right to eliminate from further consideration in this RFP process any Vendor who, in the opinion of CTS, receives an unfavorable report from a reference. CTS also reserves the right to contact other Vendor Purchasers for additional references for consideration. 17
SECTION 6 6. FINANCIAL QUOTE 6.1 Overview CTS seeks to acquire Services and products that best meet the State s needs at the lowest cost and best value. Prices must include all aspects needed for the provision of the Services described in this RFP. Failure to identify all costs in a manner consistent with the instructions in this RFP is sufficient grounds for disqualification. 6.2 (MS 125) Vendor Cost Proposal Form Vendor must include in its Response a completed Cost Proposal Form contained in Appendix E. The Cost Proposal Form will be the basis for evaluation of the Financial Response as specified in Section 7. 6.3 (M) Price List As a separate document, Vendor must provide a Price List as part of its Response in Appendix E. Such list shall include the prices for all Products/Services necessary to meet the RFP's minimum mandatory requirements. Vendor s Price List may include any additional products, software, and services appropriate to the scope of this RFP. All items on the price list must be compatible with the terms of the RFP and subsequent Contract. All prices provided in the Appendix E, Section E, Cost Model must be consistent with and crossreference the Price List. 6.4 (M) Cost Model The Cost Model form contained in Appendix E must be completed using the pricing from Vendor s proposed Price List (See Section 6.3 Price List) included in its Response. Vendor must include in the Cost Model all cost components needed for the provisioning of the Products/Services as described herein. Do not include taxes in the Cost Model form. Vendor must collect and report all applicable state taxes. All costs necessary to meet all mandatory/ mandatory scored requirements must be included. Include all the assumptions set forth in the Cost Model form when preparing your Response. 6.5 (M) Responses Responses must be complete and include pricing for each section as applicable. All costs for items necessary to perform the services described in the Cost Proposal must be presented. Vendor s Responses to Cost Proposal Form, Appendix E will be the basis of 18
evaluation of the Financial Proposal as specified in Section 7. Where there is no charge or rate, enter N/C (no charge) or zero (0) on the Cost Proposal Form, as applicable. If the Vendor fails to provide a price, the State will assume the item is free. If the Vendor states no charge for an item in the model, the State will receive that item free for the period represented in the model. 6.6 (M) Taxes Vendor must collect and report all applicable state taxes as set forth herein. 6.7 (M) Presentation of All Cost Components All elements of recurring and non-recurring costs must be identified and included prices set forth in the Vendor Cost Proposal Form (Appendix E). This must include, but is not limited to, all taxes, administrative fees, labor, travel time, consultation services, and supplies needed for the provisioning of the Services described within this RFP. Expenses related to day-to-day performance under any Contract, including but not limited to, travel, travel time, lodging, meals, and incidentals will not be reimbursed to the Vendor. 6.8 (M) Price Protection For the entire Initial Term of the Contract, the Vendor must guarantee to provide the Software/Services at the proposed rates. After the Initial Term, the proposed discounts off shall not be altered without prior CTS approval. 19
SECTION 7 7. EVALUATION 7.1 Overview The Vendor who meets all of the RFP requirements and receives the highest number of total points as described below will be declared the ASV and enter into contract negotiations with CTS. 7.2 Administrative Screening Responses will be reviewed initially by the RFP Coordinator to determine on a pass/fail basis compliance with administrative requirements as specified in Section 3, Administrative Requirements. Evaluation teams will only evaluate Responses meeting all administrative requirements. 7.3 Mandatory Requirements Responses meeting all of the administrative requirements will then be reviewed on a pass/fail basis to determine if the Response meets the Mandatory requirements. Only Responses meeting all Mandatory requirements will be further evaluated. The State reserves the right to determine at its sole discretion whether Vendor s response to a Mandatory requirement is sufficient to pass. If, however, all responding Vendors fail to meet any single Mandatory item, CTS reserves the following options: (1) cancel the procurement, or (2) revise or delete the Mandatory item. 7.4 Qualitative Review and Scoring Only Responses that pass the administrative screening and Mandatory requirements review will be evaluated and scored based on responses to the scored requirements in the RFP. Responses receiving a 0 on any Mandatory Scored (MS) element(s) will be disqualified. 7.5 EVALUATION PHASE I: Section 5 Evaluation Each scored element in Section 5 of the Response will be given a score by each technical evaluation team evaluator. The scores will be totaled for each Vendor. This total will be used in the calculation of Vendor s total score. Evaluation points will be assigned based on the effectiveness of the Response to each technical requirement. For example, if a response is worth 10 points, a scale of zero to ten will be used, defined as follows: 20