baselineRFIWhat incident response services are included — retainer-based proactive IR (guaranteed response SLA), reactive breach response, or both — and what is the contractual time-to-first-response for a declared incident?weight 3
Answer key — what a strong answer shows
Look for a specific, contractually-committed response-time SLA, not a vague 'rapid response' claim — during an active incident, hours matter.
baselineRFPDescribe the platform/tooling analysts bring to an engagement — forensic collection, malware analysis, and evidence handling — and whether findings integrate with our existing SIEM/EDR or require standing up separate parallel tooling during the incident.weight 3
Answer key — what a strong answer shows
Standing up unfamiliar parallel tooling mid-incident adds friction at the worst time — look for integration with the customer's existing stack, not a bring-your-own-black-box approach.
baselineRFIWhat is the analyst team's actual experience and certification profile (GCFA, GREM, OSCP, etc.), and can the customer request specific specializations (ransomware, nation-state, cloud-native incidents) for a given engagement?weight 3
Answer key — what a strong answer shows
Look for named certifications and specialization-matching, not a generic 'experienced team' claim — incident types vary enormously in required expertise.
baselineRFPDetail post-incident deliverables — root-cause analysis, timeline reconstruction, remediation roadmap — and the typical turnaround from incident closure to final report delivery, with a customer reference.weight 3
Answer key — what a strong answer shows
Look for a stated report turnaround time and a real customer reference; a report delivered months later has limited value for driving remediation urgency.
baselineRFIHow does the retainer model work financially — pre-purchased hours, use-it-or-lose-it versus rollover, and what happens if an incident exceeds the retained hours mid-engagement?weight 3
Answer key — what a strong answer shows
Retainer financial terms vary widely and matter operationally — look for explicit answers on hour rollover and overage handling, not just the headline retainer price.
baselineRFPExplain breach-coach/legal-privilege coordination — does the provider have established relationships with breach-coach law firms to help preserve attorney-client privilege over IR findings, and how is this workflow typically initiated?weight 3
Answer key — what a strong answer shows
Privilege preservation is a real legal consideration in breach response; look for described experience working under breach-coach direction, not a purely technical engagement model that ignores this.
baselineRFIWhat proactive readiness services are offered outside of active incidents — tabletop exercises, IR plan development/review, compromise assessments — and are these included in a retainer or separately priced?weight 3
Answer key — what a strong answer shows
Look for clear pricing separation between proactive readiness work and reactive incident hours, since bundling can obscure what's actually included in a retainer.
baselineRFPDetail surge capacity — for a large-scale incident requiring many simultaneous analysts, what is the provider's actual bench depth, and can they demonstrate having surged for a comparably-sized real incident before?weight 3
Answer key — what a strong answer shows
Look for a demonstrated real example of surge capacity at scale — bench depth claims are easy to make and hard to verify without a concrete precedent.
baselineRFIBeyond the pre-purchased retainer-hours structure, what is the rate and terms for emergency, non-retainer engagement (a customer with no existing retainer calling during an active breach), and how does response priority differ for retainer versus non-retainer customers?weight 3
Answer key — what a strong answer shows
Ask for specific emergency-engagement rates and priority terms — a customer without a pre-existing retainer needs to know exactly what happens (cost and response speed) if they call for the first time during an active breach.
baselineRFPDoes the IR team provide direct support drafting the actual regulatory breach-notification filings (not just internal technical findings), and has the firm actually filed notifications with real regulators (state AGs, GDPR supervisory authorities) on a customer's behalf before?weight 3
Answer key — what a strong answer shows
Regulatory notification drafting is a distinct, high-stakes deliverable from technical root-cause analysis — ask for real evidence of this specific capability having been used, not just general breach-response experience.
baselineRFICan the provider share a real, detailed case study or reference for a comparable incident (similar industry, similar attack type, similar scale) — not just an aggregate claim of '500+ incidents handled' — that a prospective customer can actually evaluate?weight 3
Answer key — what a strong answer shows
A specific, detailed case study (even anonymized) is far more evaluable than an aggregate incident-count claim — press for real comparable-incident detail.
baselineRFPDoes the team provide ransomware-negotiation support specifically as a distinct service, and what is their actual experience and track record with real ransom negotiations (outcome statistics, typical reduction from initial demand)?weight 3
Answer key — what a strong answer shows
Ransomware negotiation is a distinct, specialized skill from general incident response — ask for concrete outcome statistics from real negotiations, not just confirmation the service exists.
baselineRFIIs data recovery/restoration support included as part of the engagement (working with backup systems to actually restore operations), or is the engagement limited to investigation and remediation guidance with recovery left entirely to the customer's own team?weight 3
Answer key — what a strong answer shows
Investigation-only engagements leave the customer to handle actual recovery alone — ask explicitly whether hands-on recovery support is included or a separate, additional service.
baselineRFIWhat proportion of a typical engagement is remote versus requiring analysts on-site, and what is the actual response-time difference between the two for a geographically distant customer?weight 3
Answer key — what a strong answer shows
On-site response for a geographically distant customer can add real hours or days to initial response — ask for a specific breakdown of remote-versus-on-site capability and realistic timing.
baselineRFPIs the firm on the approved incident-response panel for major cyber-insurance carriers, and does the vendor coordinate directly with the customer's insurer to ensure the engagement satisfies policy requirements for coverage?weight 3
Answer key — what a strong answer shows
Many cyber-insurance policies mandate using a carrier-approved IR panel firm — ask for specific named insurer relationships rather than a generic 'we work with insurance' claim, since using a non-approved firm can jeopardize coverage.
baselineRFIWhat is the actual bench depth and simultaneous-engagement capacity during a widescale event (e.g., a mass-exploited CVE affecting many customers at once) — can the provider demonstrate they didn't have to deprioritize existing customers during a real past mass-incident event?weight 3
Answer key — what a strong answer shows
A widescale event (like a major CVE actively exploited across many organizations) can genuinely strain a provider's capacity — ask for a real example of how they handled simultaneous demand during a past mass-incident event, not just a steady-state bench-depth claim.
baselineRFPDefine potential Incident Response / Disaster Response tabletop exercise (TTX) scenarios with the ISO.weight 3
baselineRFPPlan and prepare for the TTX to include scripts and presentation materials and review with the ISO; all exercises will use simulated data and scenarios with no live systems impacted.weight 3
baselineRFPFacilitate, in person, a 3-4 hour TTX with 20-30 department leaders and IT professionals from the organization.weight 3
baselineRFPDocument TTX results within 30 days, to include documented scenarios, evaluation of the port authority's response to scenarios, and documented well-done items and opportunities for improvement of critical and high findings.weight 3
baselineRFPEstablish a formal process for incident reporting, escalation, and resolution (Incident Management).weight 3
baselineRFPProvide deep-dive incident investigations, including root cause analysis and forensic support, on an as-needed time-and-materials basis under pre-negotiated rates (Incident Response Support and Root Cause Analysis).weight 3
baselineRFPPerform real-time investigation and response to alerts, including device isolation, user suspension, and other containment actions within pre-approved parameters (Alert Investigation and Containment).weight 3
baselineRFPNotify the organization of any Cybersecurity Incident or Privacy Incident within 1 hour of becoming aware, including description, affected data/systems, individuals impacted, mitigation steps taken/recommended, and a designated incident response contact.weight 3
baselineRFPCooperate fully with the organization in investigation of cybersecurity/privacy incidents, including participating in forensic and law enforcement investigations and notification of affected individuals/media/FCC as directed.weight 3
baselineRFPProvide a Cyber Incident Response Team (CIRT) that can support the incident response lifecycle with the housing finance agency.weight 3
baselineRFPPerform periodic incident response exercises with a deliverable report and debriefing upon completion.weight 3
baselineRFPDo you have expertise in security monitoring, threat hunting, incident containment, and response? If so, describe.weight 3
baselineRFPDo you have critical incident response services? If so, describe the different types/tiers of critical incident response services available.weight 3
baselineRFPHow is your incident response team integrated into the service delivery teams, particularly the log monitoring team?weight 3
baselineRFPWhat degree do you support the Incident Response lifecycle?weight 3
baselineRFPProvide Data Breach Risk Assessment and Response Plan Development, and Information Security Risk Assessment.weight 3
baselineRFPProvide Incident Response Program Development or Review.weight 3
baselineRFPMust provide API support for seamless integration with other security tools (e.g., EDR, firewall management, IAM solutions), and should support integration with existing ticketing and incident management systems.weight 3
baselineRFPBidder is required to provide RCA for all Critical and key issues for in-scope applications within 48 hours of the issue being identified/notified, and for significant issues, submit the RCA report within timelines defined by the financial institution.weight 3
baselineRFPBidder shall share detailed information security incident report(s) with details of the incident.weight 3
baselineRFPSolution should support quick response to ongoing incidents with remote configuration of parameters in servers/desktops, firewalls, AD, IPS, WAF, and network switches/routers, and support automated remediation for commodity threats (e.g. recall malicious mails, block bad IPs, disable bad users in AD).weight 3
baselineRFPSecurity Incident and Crisis Management (one-time onboarding service): align the Security Incident management plan with the financial institution's Cyber Crisis Management Plan (CCMP) and Cyber Security Policy, develop a response plan/strategy prioritizing incidents by organizational impact, perform root cause analysis and recommend controls to prevent reoccurrence, and provide on-demand forensic analysis of logs.weight 3
baselineRFPContinuous 24x7x365 monitoring is required for all alert severities, not just critical/high after business hours; the MSSP is expected to provide incident coordination, triage, investigation, root cause analysis, and remediation support (within defined authority boundaries) as part of SOC operations, with full forensic investigation/malware analysis available via the professional services block if requested.weight 3
baselineRFPProposal must clearly describe authority boundaries for three tiers of response action: (1) non-disruptive playbook actions authorized without prior agency approval, (2) actions requiring standing agency approval (e.g. account disable/reset, endpoint isolation, blocking IOCs at firewall/proxy/email), and (3) actions requiring explicit agency authorization (changes outside Sentinel, destructive actions, external communications) — including an emergency exception process for confirmed active incidents threatening public safety or critical agency services.weight 3
baselineRFPMSSP must deliver at least one annual tabletop exercise (scenario themes prioritizing phishing compromise, ransomware, privileged account misuse), with technical teams and leadership participation and a mutually agreed after-action reporting format.weight 3
baselineRFPContractor shall perform a technical/procedural review of every incident and high-priority event, including gap identification, Root Cause Analysis (RCA), and posture recommendations to improve detection, prevention and response capabilities.weight 3
baselineRFPContractor shall lead enterprise IR readiness via an annual Incident Response Tabletop Exercise (TTX) plan developed with the Privacy team, designing at least 3 distinct high-fidelity scenarios per exercise (incorporating both cybersecurity e.g. ransomware and privacy e.g. PII breach components), and delivering a formal After-Action Report within 10 business days of TTX conclusion.weight 3
baselineRFPProvide user behaviour analysis to identify potential internal and external threats; assist the Bank's active participation in cyber drills conducted under CERT-In/IDRBT; coordinate with internal/external contact groups to monitor, analyze and escalate security incidents, developing protect/detect/respond/recover capability for cyber-attacks.weight 3
baselineRFPContractor shall serve as system liaison to the Security Controls Assessor (SCA), penetration tester, and for overall system security purposes for both internal and external parties, and compile documentation and supporting materials required for each system assessment, including SSP, Risk Assessment Report, Contingency Plans and Test Results, SORN, FIPS 199, Configuration Management Plan, Cybersecurity and Privacy Incident Response Plan, and Disaster Recovery Plan.weight 3
baselineRFPSelected bidder is responsible for product updates/upgrades (including version upgrades) throughout the contract at no additional cost; in the event of a Data Leakage incident, the onsite engineer must prepare and submit a Root Cause Analysis to the financial institution.weight 3
baselineRFPDescribe your expected response time to notify us if a cyber-attack or security breach should occur and the actions you would take to mitigate damages.weight 3
baselineRFPUpon request, promptly provide copies of information security policies covering data classification, security training/awareness, systems administration/patching/configuration, application development/code review, incident response, disaster recovery/business continuity, data/system backup, and compliance with information security/privacy laws, regulations, or standards.weight 3
baselineRFPReport any breach of vendor system to the university's Chief Information Security Officer in accordance with the applicable state data breach notification law and the European Union General Data Protection Regulation.weight 3
baselineRFPWhat is your procedure for handling a data breach and how will the university be notified?weight 3
baselineRFPVendor will maintain, update and document an Incident Response Plan (IRP) and notify the university's designated security contact of a Security Incident as soon as reasonably practicable and without undue delay, including a description of the incident, type, location, data involved, and containment/eradication plan.weight 3
baselineRFIWhat is the vendor process for communicating a security breach or incident to its customers?weight 3
baselineRFIVendor shall provide notice to the agency within eighteen (18) hours of becoming aware of any security breach that has or may negatively impact the agency's data and/or information systems, via both encrypted email to the CISO (using a standardized breach-notification subject line) and a voice call to the IT Service Desk, with defined minimum content for initial, follow-up, and closure reports.weight 3
These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.
