baselineRFIWhat data sources and connectors are supported out of the box, how is ingestion priced (data volume / EPS / assets), and can data be tiered or filtered to control cost?weight 3
Answer key — what a strong answer shows
Strong answers quantify connector breadth, state the pricing model plainly, and show data-tiering/pipeline controls to manage cost. Probe whether security value is gated behind premium ingest tiers.
Sources: splunk.com · exabeam.com · sumologic.com
baselineRFIWhat out-of-the-box detection content and MITRE ATT&CK coverage are included, is behavioral analytics (UEBA) native, and how are detections kept current?weight 3
Answer key — what a strong answer shows
Look for a maintained detection library mapped to ATT&CK, native UEBA (not a separate product), and a clear content-update cadence. Distinguish vendor-authored content from community rules.
Sources: exabeam.com · securonix.com · splunk.com
baselineRFPDescribe investigation workflows, case management, and built-in SOAR/automation; quantify analyst time-to-investigate improvements.weight 3
Answer key — what a strong answer shows
Evidence-backed answers show case management, whether SOAR is native or an add-on, and concrete automation, with measured time-to-investigate/respond from customers rather than marketing.
Sources: splunk.com · elastic.co · securonix.com
baselineRFIWhich deployment options (SaaS, self-hosted, hybrid) and data-residency/region controls are offered, and is search performance consistent across them?weight 3
Answer key — what a strong answer shows
Strong answers state deployment models, residency/region controls, and whether search/analytics performance is consistent across them or degrades self-hosted.
Sources: sumologic.com · elastic.co · exabeam.com
baselineRFIWhat AI/agentic capabilities assist triage, investigation, and detection engineering, and how are AI decisions made transparent and auditable?weight 3
Answer key — what a strong answer shows
Look for AI that summarizes/triages with human-in-the-loop and an auditable rationale, not opaque verdicts. Ask what data trains/grounds the AI and where it runs.
Sources: exabeam.com · securonix.com · elastic.co
baselineRFPDetail retention tiers (hot/warm/cold), search performance at scale, and the total cost drivers, with customer-validated figures.weight 3
Answer key — what a strong answer shows
Prefer answers with explicit retention tiers, real scale/search numbers, and transparent cost drivers backed by customer references — not just 'unlimited' or 'predictable' claims.
Sources: splunk.com · sumologic.com
baselineRFIDoes the platform natively correlate endpoint, cloud, identity, and network telemetry (toward XDR), or does that rely on integrations?weight 3
Answer key — what a strong answer shows
Strong answers separate first-party/native domains from integrations and explain how correlation works across them and what is lost without the vendor's own endpoint/identity sources.
Sources: crowdstrike.com · microsoft.com · elastic.co
baselineRFPDetail migration from an incumbent SIEM: content portability, query language/openness, and lock-in considerations, citing references.weight 3
Answer key — what a strong answer shows
Prefer concrete migration tooling, portable detection content, an open/queryable language, and honest lock-in discussion (e.g., proprietary pipelines or pricing that penalizes egress).
Sources: splunk.com · exabeam.com · sumologic.com
baselineRFIDoes the platform provide compliance-specific log-retention and reporting capability (PCI DSS, HIPAA required retention windows, audit-ready report templates), or does the customer need to build custom reports/retention policy to meet regulatory requirements?weight 3
Answer key — what a strong answer shows
Native compliance report templates and configurable retention policies matched to specific regulatory windows are materially stronger than a generic log store requiring custom report-building for every audit.
baselineRFPDescribe support for multi-tenant/MSSP deployments — can a service provider manage multiple distinct customer environments from one instance with proper data isolation, and what is the pricing/licensing model for that use case?weight 3
Answer key — what a strong answer shows
Look for genuine tenant isolation (not just filtered views into one shared dataset) and an explicit MSSP pricing tier if that's the buyer's use case.
baselineRFIWhat professional-services or content-authoring support is available for building custom detection rules specific to the customer's environment, and is this included in the subscription or a separate paid engagement?weight 3
Answer key — what a strong answer shows
Strong answers are explicit about what's included versus a paid add-on — a customer with no in-house detection-engineering expertise needs to know this cost exists before signing.
baselineRFPDetail the query language and threat-hunting interface — is it approachable for an analyst without deep query-language expertise, and what training/ramp-up time does a customer reference report for a new analyst to become self-sufficient?weight 3
Answer key — what a strong answer shows
Strong answers give a concrete, customer-validated ramp-up timeline; a powerful but expert-only query language creates a real staffing bottleneck for smaller SOC teams.
baselineRFIHow does the platform handle data normalization across disparate log sources (different field names/formats/timestamps) so that correlation rules work consistently, and is normalization automatic or does it require manual field mapping per source?weight 3
Answer key — what a strong answer shows
Automatic, well-maintained normalization is a major differentiator — manual per-source field mapping is a significant hidden implementation cost often underestimated during evaluation.
baselineRFIWhat is the maximum tested scale (events per second, total daily data volume) the platform has handled for a real customer, and what happens to search/query performance as data volume grows toward that ceiling?weight 3
Answer key — what a strong answer shows
Look for a real customer-validated scale figure and honest performance degradation characteristics near capacity, not just a marketing claim of 'infinitely scalable.'
baselineRFPExplain incident-response escalation integration — when the SIEM identifies a likely major incident, does it have a direct, automated escalation path to an IR team or retainer service, or does escalation rely entirely on manual analyst judgment and separate tooling?weight 3
Answer key — what a strong answer shows
An automated or semi-automated escalation path reduces response time for genuinely critical incidents versus relying purely on an analyst noticing and manually initiating escalation.
baselineRFIWhat alert-tuning support is provided to reduce false-positive fatigue over time — is there a structured tuning methodology/service, or is the customer expected to self-tune through trial and error?weight 3
Answer key — what a strong answer shows
A structured tuning methodology or dedicated tuning service materially reduces the well-known SIEM alert-fatigue problem faster than unassisted trial-and-error tuning.
baselineRFPProvide proof of BAS integration with Security Information and Event Management (SIEM) systems and Security Orchestration, Automation, and Response (SOAR) platforms.weight 3
baselineRFPImplement monitoring tools for server and workstation health, with 24/7 alerting for proactive issue resolution and concurrent email notification to the airport authority.weight 3
baselineRFPProvide the airport authority with access to monitoring tools for transparency and oversight.weight 3
baselineRFPEstablish centralized monitoring, alerting, and incident response capabilities across on-premises, cloud, and hybrid environments.weight 3
baselineRFPIntegrate with key components of the existing IT ecosystem, including Heimdal EDR, Cisco Meraki, Microsoft 365, Azure AD, and on-prem Active Directory.weight 3
baselineRFPSupport compliance and auditing requirements aligned with standards such as NIST CSF, CJIS, ISO 27001, HIPAA, and PCI-DSS.weight 3
baselineRFPEnable long-term scalability and adaptability through flexible architecture and support for emerging technologies.weight 3
baselineRFPConduct a full assessment of the current IT and security landscape, identifying critical systems, existing log sources, and visibility gaps.weight 3
baselineRFPDeploy the SIEM/SOAR platform, including infrastructure provisioning (cloud, on-premises, or hybrid), log pipeline configuration, and baseline use case deployment.weight 3
baselineRFPProvide required parsing support for Azure AD, on-prem AD, M365 (Exchange, Teams, SharePoint), Heimdal EDR, Cisco Meraki, and core firewall(s), with future support for identity management platforms, additional/replacement EDR solutions, and third-party SaaS tools (Phase 2+).weight 3
baselineRFPUse vendor-recommended or supported connectors and tools for log parsing, normalization, and onboarding.weight 3
baselineRFPProvide architecture diagrams, integration mappings, and configuration documentation.weight 3
baselineRFPSupport minimum log retention of 30-90 days hot storage, 12 months warm storage, and 5 years cold storage, with options for extended retention if required by regulation.weight 3
baselineRFPSupport an initial throughput of up to 5,000 events per second (EPS), scalable to at least 15,000 EPS within three years; specify hardware or cloud resource sizing to meet these thresholds.weight 3
baselineRFPInclude compression ratios, indexing strategies, and storage growth estimates in the technical proposal.weight 3
baselineRFPAlign with NIST CSF, CJIS, HIPAA, and PCI-DSS requirements.weight 3
baselineRFPEnsure encryption in transit and at rest, immutable log storage, and verifiable audit trails.weight 3
baselineRFPProvide customizable dashboards and compliance reporting with exportable data.weight 3
baselineRFPUtilize identity enrichment and correlation for improved event context and detection fidelity.weight 3
baselineRFPProvide at least three examples of comparable SIEM/SOAR deployments within hybrid environments of similar scale (log volume, EPS, and integration complexity).weight 3
baselineRFPInclude staff certifications relevant to the proposed solution, such as CISSP, CISM, GIAC, or vendor-specific credentials (e.g., Microsoft, Splunk, IBM, Palo Alto).weight 3
baselineRFPIdentify key project personnel and their certifications, roles, and project responsibilities.weight 3
baselineRFPDemonstrate successful integrations with Azure AD/on-prem AD (hybrid identity), Microsoft 365 services (Exchange, Teams, SharePoint, OneDrive), and Heimdal EDR, Cisco Meraki, and comparable platforms.weight 3
baselineRFPList available native connectors and describe any customization required to achieve full ingestion and correlation.weight 3
baselineRFPDeliver role-based training programs tailored for administrators, analysts, and IT staff, with minimum required training hours: Administrators 12 hours, Security Analysts 16 hours, IT/Helpdesk Staff 8 hours.weight 3
baselineRFPProvide training deliverables, including recorded sessions and presentation materials, hands-on playbook development labs, and quick-reference guides/SOP documentation.weight 3
baselineRFPDefine Service-Level Agreements (SLAs) including critical issue response <1 hour, high severity resolution <4 hours, routine support <24 hours, and patch/update cadence quarterly at minimum.weight 3
baselineRFPInclude escalation procedures, after-hours availability, and performance tracking.weight 3
baselineRFPProvide post-go-live services for tuning, optimization, and platform health checks during the first 90 days.weight 3
baselineRFPDescribe platform scalability for increased log volume, new data sources, and user roles.weight 3
baselineRFPHighlight support for machine learning analytics, UEBA, threat intelligence ingestion, and open API integration to accommodate evolving needs.weight 3
baselineRFPProvide a detailed pricing breakdown separating licensing/subscription costs, professional services, hardware/infrastructure, ongoing support & maintenance, and multi-year (3-5 year) lifecycle pricing including renewal costs and projected increases.weight 3
baselineRFPDeliver a fully operational SIEM/SOAR solution meeting the required parsing support integration scope, documented discovery findings/architecture/integration strategy, configured log sources, custom and baseline correlation rules/detection logic/playbooks, operational runbooks/SOPs/training materials, and a final tuning report and scalability roadmap.weight 3
baselineRFPFollow a phased implementation approach: Discovery & Planning; Platform Deployment; Log Source Onboarding & Use Case Development; Playbook Development & Automation; Training, Handoff, & Go-Live — each phase including timeline/milestone tracking, change management artifacts, stakeholder review/sign-off, and UAT/validation reports.weight 3
baselineRFPAssign a dedicated Project Manager responsible for coordinating implementation phases, serving as primary point of contact, providing weekly status/risk tracking/documentation updates, and ensuring schedule adherence and proactive issue resolution.weight 3
baselineRFPSupport final acceptance testing based on verified log ingestion/normalization from all Day 1 sources, successful correlation rule triggering and playbook automation, confirmed dashboard/reporting functionality, RBAC enforcement validation, completion of role-based training, and signed stakeholder approval.weight 3
baselineRFPProvide detailed information on the firm's methodology in meeting the scope of work requirements, including a proposed project plan outline, schedule, and deliverables with an end date on or before September 30, 2026.weight 3
baselineRFPSubmit a pricing breakdown including upfront costs, hardware, recurring monthly charges, anticipated/required maintenance, and miscellaneous implementation costs.weight 3
baselineRFPProvide an estimate of total project cost including upfront initial costs, equipment, maintenance, communications/network services implementation and recurring costs, monthly services, and implementation services; highest-rated proposer must also provide a detailed fee schedule with direct/indirect labor rates.weight 3
baselineRFPDesign the architecture with future expansion in mind, including integration of identity, network, and infrastructure logs to support broader correlation and detection capabilities.weight 3
baselineRFPUtilize Microsoft-native tools and services, including Microsoft Defender for Endpoint, Microsoft Sentinel, Microsoft Defender for Office 365, and Microsoft Purview Audit.weight 3
baselineRFPSupport integration of telemetry sources including endpoint telemetry (Windows/iOS/Android), M365 audit logs, Azure AD sign-in/activity logs, AD identity/authentication logs, DNS/DHCP logs, firewall logs, and server infrastructure telemetry.weight 3
baselineRFPConfigure Microsoft Sentinel within the agency's tenant, including data connectors, initial analytics rules/workbooks/dashboards, RBAC for agency and vendor staff, and alerting/escalation workflows.weight 3
baselineRFPUse the latest threat detection and response technologies including SIEM, EDR/MDR, and threat intelligence platforms with a well-defined process for detecting and responding to security threats and vulnerabilities.weight 3
baselineRFPProvide centralized logging into a SIEM or SIEM-like system.weight 3
baselineRFPDoes your solution accept feeds from security devices, network devices, applications, endpoints, and databases? Describe the devices your solution supports and any it does not support.weight 3
baselineRFPDescribe your process for identifying relevant security events from logs feeding into your system. Explain the types of events you process from Windows hosts, Linux hosts, databases, routers, and switches, and how your rules engine correlates these events.weight 3
baselineRFPDo you enrich log data with contextual elements such as IP reputation, Geo IP, or assets? If so, describe.weight 3
baselineRFPWhat are your analytic and correlation capabilities? Describe the continuum of automated processing and categorizing of threats within your system, and the validation tools/processes utilized.weight 3
baselineRFPDoes your solution analyze and correlate data to identify security events and classify events according to severity? Are you able to correlate events across clients/endpoints? Can you correlate events by identity (user)?weight 3
baselineRFPMust support log ingestion from at least 2,800 Windows endpoints, 300 MacBooks, 120 Windows servers, 30 Linux servers, 400 Cisco switches/routers, and various security appliances.weight 3
baselineRFPMust support log collection from cloud services, including but not limited to Google Workspace (Admin, Drive, Gmail, etc.), Microsoft Entra ID, Microsoft 365 Security logs, and any additional SaaS or IaaS platforms utilized by the school district.weight 3
baselineRFPMust allow for ingestion via industry-standard protocols (e.g., Syslog, API, agent-based collection, etc.).weight 3
baselineRFPMust provide a robust correlation engine capable of linking disparate logs and events to detect complex attack patterns.weight 3
baselineRFPMust support custom rule creation and modification for advanced threat detection.weight 3
baselineRFPMust include pre-built correlation rules aligned with industry best practices (MITRE ATT&CK, CIS, etc.).weight 3
baselineRFPShould offer machine learning (ML) or AI-based behavioral analytics to detect anomalies.weight 3
baselineRFPMust integrate with real-time threat intelligence feeds to detect and alert on known Indicators of Compromise (IOCs).weight 3
baselineRFPMust provide customizable alerting via email, SMS, and integrations with ticketing systems.weight 3
baselineRFPShould support a log retention period of at least 12 months for critical logs, with configurable options for longer retention if required.weight 3
baselineRFPMust handle high-volume log ingestion without performance degradation, and must offer a scalable architecture supporting on-premise, cloud, or hybrid deployment models.weight 3
baselineRFPMust provide a user-friendly, web-based interface with intuitive dashboards.weight 3
baselineRFPMust include pre-built and customizable reporting for compliance and security analytics, and should provide compliance-specific reports.weight 3
baselineRFPMust support role-based access control (RBAC) to restrict SIEM access by role.weight 3
baselineRFPMust encrypt logs in transit and at rest.weight 3
baselineRFPMust provide API support for seamless integration with other security tools (e.g., EDR, firewall management, IAM solutions), and should support integration with existing ticketing and incident management systems.weight 3
baselineRFPVendors should provide pricing for different deployment models and include cost breakdowns for licensing (per user, per endpoint, per GB, etc.), support and maintenance, and additional features (e.g., SOAR, extended retention, custom integrations).weight 3
baselineRFPThe bidder should be a company registered in India under the relevant acts (Companies Act 2013, Indian Partnership Act 1932, or LLP Act 2008), with its registered office in India.weight 3
baselineRFPThe bidder should have experience of a minimum of 5 years in providing IT/IT services.weight 3
baselineRFPThe OEM should be a Software Development, IT Application & Maintenance company registered/incorporated under Indian company Act and must have 10 years of existence in India as on date of submission of bids.weight 3
baselineRFPThe Bidder should have an average annual turnover of INR 3 crore in the past three financial years with a positive net worth in at least 2 years, and the OEM should have average annual turnover of INR 300 crore in the past three financial years in India.weight 3
baselineRFPThe Bidder should not have been blacklisted at the time of submission of the bid by any Regulator / Statutory Body / any Government Department / PSU / PSE / Financial Institution in India.weight 3
baselineRFPThe bidder should be the authorized partner of the OEM, evidenced by a Manufacturer Authorization Form confirming product details, authorization to submit the proposal for the entire contract duration, and OEM's commitment to sign the Agreement and NDA ensuring compliance to the Scope of Work.weight 3
baselineRFPThe proposed SIEM solution should be from a single OEM, and the OEM/System Integrator should have experience in the end-to-end implementation of the proposed solution.weight 3
baselineRFPThe bidder should have at least 50 Functional/IT Professionals on its payroll as on the date of bid opening.weight 3
baselineRFPThe OEM should hold at least 3 industry-recognized certifications for quality management and information security standards (any 3 of ISO 9001, ISO 27001, ISO 27017, ISO 27018 or equivalent).weight 3
baselineRFPThe bidder should have experience delivering a SIEM project in BFSI/PSU/PSE/Government Organization in India within the last 3 years as on the date of bid opening, evidenced by a copy of the contract/purchase order and client confirmation.weight 3
baselineRFPThe proposed Cloud Service Provider (CSP) must be empaneled with MeitY as on the date of bid submission for the proposed sites, or hold ISO 27001, ISO 27017, ISO 27018, and ISO 20000 certifications; its data centers should be minimum Rated 3 of TIA942 or Tier 3 or equivalent.weight 3
baselineRFPThe CSP should have experience of provisioning services on their cloud for at least 3 clients in India during the last 5 years, of which 1 should be PSU/Central Govt/State Govt and 1 should be BFSI; the CSP's primary and secondary sites for the project should be in two different, geographically well-separated locations in India.weight 3
baselineRFPBidder is required to design and implement the SIEM tool on Cloud, with all modules sourced from a single OEM, and ensure security updates/upgrades/patches in the production environment.weight 3
baselineRFPBidder must ensure that all in-scope application & infrastructure enables generation and monitoring of logs, and provides comprehensive audit trail features with access control list generation.weight 3
baselineRFPThe system shall provide daily activity logs as well as history logs (1-2 months online, post which the logs should be archived); it is the bidder's responsibility to ensure the storage, retention and offsite backup of logs.weight 3
baselineRFPBidder shall store all logs for a minimum period of one year (1-2 months online, then archival), must be capable of being downloaded, and must provide stored logs to the financial institution within one day's notice at no additional cost.weight 3
baselineRFPIntegrate and monitor all logs through a SIEM; create correlation rules, customize existing rules and use cases for effective security monitoring and incident reporting; use proven threat feeds to proactively identify threats in the environment.weight 3
These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.
