EGBA, "External Attack Surface Management (EASM) Tool" RFI

Background
The State of Colorado’s Office of Information Technology (OIT) is responsible for providing IT resources to Executive branch agencies and other State government entities, including technology infrastructure, software, hardware, storage, telecommunication, public safety radio, cyber security, and related professional services. The Request for Information (RFI) has been issued to understand the market of External Attack Surface Management tools and solutions.

Work Details
The State of Colorado is interested in the following requirement categories: Detection, Integration, Configuration, Reporting, Process Improvement, and Usability of the offering’s proposed solution. The specific requirements include identification of unknown assets both internal and internet facing, detection of typosquatting/spoofed web portals, certificates, vulnerabilities, misconfigurations/risk & compliance issues, open ports, continuous monitoring, supply chain monitoring, integration with asset management tools and other systems for alert reporting interoperability, configuration for group-based agency monitoring without relying on the vendor, clear & concise data reporting with actionable data and low false positives, scheduled reporting, breach attack simulation, awareness of vendor risk management services, flexibility to (re)prioritize findings and execute lateral movement attack BSA. Additionally, the solution should have multi-tenant capabilities and unlimited discovery licensing with easy cleanup of old or non-related assets while clearly showing discovery paths for assets and issues discovered.

Period of Performance
The schedule of activities includes solicitation publication on 7/3/2024; written inquiry deadline on 7/19/2024; state response to written inquiries on 7/23/2024; and vendor response submission deadline on 8/1/2024.

Place of Performance
The responses should be submitted via email to the procurement point of contact identified in the solicitation.