baselineRFIWhat intelligence sources feed the platform (open-source, proprietary human-collected, dark web/closed-forum monitoring, technical telemetry from sensors), and what proportion of indicators/reports come from each?weight 3
Answer key — what a strong answer shows
Strong answers give a real breakdown by source type; be skeptical of vendors who can't say roughly how much of their feed is OSINT versus genuinely proprietary collection.
baselineRFPDescribe how raw intelligence is enriched and scored for relevance to a specific customer's industry, geography, and tech stack, and quantify the noise/false-positive reduction versus a raw feed with a customer reference.weight 3
Answer key — what a strong answer shows
Look for a concrete relevance-scoring methodology and a real noise-reduction figure backed by a named customer, not a generic 'tailored intelligence' claim.
baselineRFIHow does the platform deliver finished intelligence — machine-readable feeds (STIX/TAXII), API, or human-written analyst reports — and what is the update/refresh cadence for each?weight 3
Answer key — what a strong answer shows
Strong answers state a specific cadence per delivery format; a vendor offering only a generic PDF report with no machine-readable feed is weaker for SOC integration.
baselineRFIWhat is the actor and campaign attribution methodology, and how are confidence levels expressed and revised as new evidence emerges?weight 3
Answer key — what a strong answer shows
Look for explicit confidence levels (e.g., low/moderate/high with stated criteria) that get revised over time, versus static, unqualified attribution claims.
baselineRFPDetail the integration path into SIEM/SOAR for automated indicator matching and alerting, including how false-positive indicators are suppressed or aged out without manual tuning.weight 3
Answer key — what a strong answer shows
Strong answers describe automatic indicator aging/expiry and confidence-based filtering, not a firehose that requires constant manual suppression rules.
baselineRFIDoes the platform provide dark-web/credential-leak monitoring specific to the customer's domains and executives, and what is the average time-to-detection for a leaked credential compared to public breach disclosure?weight 3
Answer key — what a strong answer shows
A concrete time-to-detection figure that beats public disclosure timelines is meaningful evidence; vague 'we monitor the dark web' claims are not.
baselineRFPExplain the analyst-access model — can customers request bespoke research or ask an analyst questions directly, what are typical response SLAs, and is this included or a paid tier?weight 3
Answer key — what a strong answer shows
Strong answers state a concrete SLA and clarify whether analyst access is included or gated behind a premium tier — pricing transparency matters here.
baselineRFIHow is vulnerability intelligence (exploited-in-the-wild status, exploit maturity) correlated with the customer's own asset inventory to prioritize patching, versus generic CVSS scoring?weight 3
Answer key — what a strong answer shows
Look for genuine asset-correlation (requires an asset inventory integration) rather than a standalone exploited-in-the-wild feed with no link to what the customer actually runs.
baselineRFIDoes the platform provide sector-specific intelligence (e.g., financial services, healthcare, critical infrastructure) through ISAC/ISAO partnerships or dedicated vertical research teams, versus a single generic feed for all industries?weight 3
Answer key — what a strong answer shows
Look for named ISAC/ISAO partnerships or a dedicated vertical research team; a vendor offering only one undifferentiated feed across all industries provides materially less relevant intelligence.
baselineRFPDescribe brand and executive protection capabilities — detection of typosquat/impersonation domains, fake social media profiles, and leaked executive credentials — and the average takedown time for a confirmed malicious domain, with a customer reference.weight 3
Answer key — what a strong answer shows
Strong answers include a concrete takedown-time figure and describe the actual takedown mechanism (registrar/host relationships), not just detection with no remediation path.
baselineRFIHow does the platform specifically track and profile active ransomware groups (leak-site monitoring, negotiation-tactic intelligence, decryptor availability), and how current is that tracking relative to a group's most recent activity?weight 3
Answer key — what a strong answer shows
Look for near-real-time leak-site monitoring and specific group-level profiles, not a static list of 'known ransomware families' updated infrequently.
baselineRFPExplain intelligence-sharing and collaboration features — does the platform support TLP (Traffic Light Protocol) labeling, and can customers share curated intelligence with peers or industry groups directly from the platform?weight 3
Answer key — what a strong answer shows
Native TLP support and peer-sharing workflows indicate a mature, community-integrated platform; a vendor with no sharing mechanism forces customers into manual, ad-hoc collaboration.
baselineRFIWhat is the pricing model — per analyst seat, per data volume/API call, or flat enterprise license — and how does cost scale when adding additional intelligence modules (e.g., dark web monitoring) to a base subscription?weight 3
Answer key — what a strong answer shows
Look for transparent incremental-module pricing; vendors who bundle everything into an opaque enterprise quote make budget comparison difficult.
baselineRFIHow has the platform's false-positive/noise rate improved over the past 12-24 months, and what mechanism (customer feedback loop, ML retraining) drives that improvement — can this be shown with a concrete before/after metric?weight 3
Answer key — what a strong answer shows
A vendor able to show a measured noise-reduction trend with a real mechanism behind it is stronger than one claiming static 'high accuracy' with no historical comparison.
baselineRFPDetail API rate limits and enterprise-scale query volume support — can a large SOC/SIEM integration query the platform continuously at production scale without hitting throttling, and what is the documented rate limit?weight 3
Answer key — what a strong answer shows
Strong answers state a specific rate limit or confirm unlimited enterprise-tier access; vague 'contact us for enterprise limits' answers should be pressed for real numbers before signing.
baselineRFIDoes the platform provide physical security or geopolitical risk intelligence (e.g., civil unrest, facility-proximity threats) alongside cyber intelligence, or is that entirely out of scope and requiring a separate vendor?weight 3
Answer key — what a strong answer shows
This is a genuine scope question — not every buyer needs physical/geopolitical intelligence, but a vendor should be clear about the boundary rather than implying broader coverage than they actually have.
baselineRFPUse the latest threat detection and response technologies including SIEM, EDR/MDR, and threat intelligence platforms with a well-defined process for detecting and responding to security threats and vulnerabilities.weight 3
baselineRFPProvide continuous notifications concerning the latest and ongoing cybersecurity threats and vulnerabilities.weight 3
baselineRFPProvide real-time threat intelligence, especially for zero-day or emerging threats, with up-to-date protection within its system(s).weight 3
baselineRFPDo you enrich log data with contextual elements such as IP reputation, Geo IP, or assets? If so, describe.weight 3
baselineRFPHow are you developing detections that exceed commodity threat intelligence?weight 3
baselineRFPDo you have a dedicated team for security research? If so, describe the focus of the research and how they will work with the customer's IT team.weight 3
baselineRFPAs you continuously research threats and trends, how quickly can you implement those findings into your systems?weight 3
baselineRFPDoes your security research team develop threat reports? If so, how often? Please attach any relevant reports as examples.weight 3
baselineRFPDemonstrate the ability to deliver anonymized, aggregated threat data to a separate platform for collective analysis and information sharing.weight 3
baselineRFPFocus on actionable events for customer notification and real-time monitoring schemes that reduce/prioritize the volume of data requiring quick analysis; apply knowledge of external threats and of the types/numbers of attacks encountered across all monitored customer devices to add value to alert analysis for the agency.weight 3
baselineRFPMust integrate with real-time threat intelligence feeds to detect and alert on known Indicators of Compromise (IOCs).weight 3
baselineRFPShould provide an up-to-date database of known malicious IPs, domains, and signatures.weight 3
baselineRFPIntegrate and monitor all logs through a SIEM; create correlation rules, customize existing rules and use cases for effective security monitoring and incident reporting; use proven threat feeds to proactively identify threats in the environment.weight 3
baselineRFPThreat Intelligence Integration: integrate threat intelligence feeds, configure IOC ingestion and automated enrichment, and enable threat correlation.weight 3
baselineRFPSolution should provide case management features to store raw and analysed data for a specific alert or set of alerts, provide run books for investigation steps corresponding to different types of attacks, and support integration with open source or commercial IOC sources — list the supported sources and integration approach.weight 3
baselineRFPService should support integration of machine-readable threat intelligence from open and commercial sources with weighting/noise-reduction algorithms, support STIX/TAXII for automated integration of actionable intelligence, and analyse the financial institution's susceptibility to strategic threat intelligence shared by the organization, providing IOCs and mitigation steps for each advisory.weight 3
baselineRFPFunctional requirements: ability to protect critical infrastructure from ongoing security threats; 24x7 log and security event monitoring across IT infrastructure, WAN, ATM, Internet banking, mobile banking and interfaces (servers, routers, firewalls, IDS); evaluation of cyber security incidents including origin-of-threat identification, chain-of-custody/evidence preservation, and proactive threat intelligence impact assessment.weight 3
baselineRFPSolution should detect multiple event types (inappropriate application use, fraud, advanced low-and-slow threats, APTs), collect Layer 7 network flow data from switches/routers/firewalls/DHCP, correlate global threat intelligence feeds against collected logs to identify IOC activity, and analyze user activity patterns for anomaly/behavioral detection across applications, hosts, users and network.weight 3
baselineRFPContractor shall provide support for Cyber Hygiene by developing and executing procedures for capturing and tracking through to remediation all vulnerabilities reported by federal sources (e.g. DHS Binding Operational Directive 22-01), generating specific reports at least bi-weekly.weight 3
baselineRFPDemonstrate advanced operational security capabilities, including custom tooling and proprietary techniques (not exclusively relying on public frameworks), OPSEC practices to avoid premature detection, threat actor emulation based on MITRE ATT&CK, anti-forensics/artifact minimization techniques, and ability to operate covertly for extended engagements.weight 3
baselineRFPIndicate your industry involvement, including membership(s) in industry organizations, participation in standards bodies and participation in the threat intelligence community, and provide a list of your solution partners.weight 3
baselineRFPHow do you protect against outside threats?weight 3
These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.
