Presently, there is not a Security Information Event Management We understand that the DOR requires a (SIEM) product with which we continuous security monitoring framework to are expecting the new system to allow comprehensive and proactive monitoring to integrate. However, the new actively identify new security vulnerabilities. Is modernized tax system should 16 I-3.E 13 Security Event Information Management (SEIM) support and be capable of product implemented at DOR with which offeror sending event messages via is expected to integrate? Does DOR have a syslog. This capability should preference? allow integration with any SIEM solution that is implemented moving forward. The proposed solution is We understand the DOR requires the proposed expected to integrate with our solution to meet the information Active Directory domain to security and privacy commonwealth requirements provide single sign on and the ability to leverage the existing user store functionality for Commonwealth and authentication system. We understand that users and internal application the DOR would like the vendor to integrate the 17 80 III-6.F.30 and with our proprietary proposed solution with the existing user store user store called including Single Sign On, authentication, for external facing and multifactor authentication and authorization internet applications. DOR does systems. Are these tools implemented at DOR not currently implement a with which offeror is expected to integrate? Does multifactor authentication and DOR have a preference? authorization system.
16 13 I-3.E We understand that the DOR requires a continuous security monitoring framework to allow comprehensive and proactive monitoring to actively identify new security vulnerabilities. Is Security Event Information Management (SEIM) product implemented at DOR with which offeror is expected to integrate? Does DOR have a preference? Presently, there is not a Security Information Event Management (SIEM) product with which we are expecting the new system to integrate. However, the new modernized tax system should support and be capable of sending event messages via syslog. This capability should allow integration with any SIEM solution that is implemented moving forward. 17 80 III-6.F.30 We understand the DOR requires the proposed solution to meet the information security and privacy commonwealth requirements and the ability to leverage the existing user store and authentication system. We understand that the DOR would like the vendor to integrate the proposed solution with the existing user store including Single Sign On, authentication, multifactor authentication and authorization systems. Are these tools implemented at DOR with which offeror is expected to integrate? Does DOR have a preference? The proposed solution is expected to integrate with our Active Directory domain to provide single sign on functionality for Commonwealth users and internal application and with our proprietary user store called for external facing and internet applications. DOR does not currently implement a multifactor authentication and authorization system.
Solicitation_43.docx&OriginalFileName=Questions%20and%20Answers%20Tax%20Modernization.%20rev%20(2.24.17).docx