Please Confirm Your Willingness to Extend All Provided Pricing to Other Governmental Bodies

RFP 17-095 Technical Proposal Attachment F

INSTRUCTIONS  Please supply ALL requested information in the blue-shaded areas and indicate any attachments that have been included.  Document all attachments with which section and question they pertain to.

Mandatory Requirement Please confirm your willingness to extend all provided pricing to other governmental bodies.

2.4.1 CYBER TRAINING Please address the following questions on the cyber training (not phishing training).

2.4.1.1 Product platform(s) – Discuss the platforms of your product. For example, is the training SCORM based or delivered via a hosted solution? If options are available, discuss the differences, if any, between either the scopes of the catalog for the platforms, differences in content, or variances in the delivery methods (interactive, video, etc.).

2.4.1.2 Training module content and delivery methodology – Discuss the features, capabilities, and intellectual property contained in your product. Discuss the factors, or combination of factors, that make your product capable of effectively reducing human errors and thus improving the security posture of the state of Indiana. Include in this section the information the State can use to verify/validate your claims. This may include academic research, documented case studies and/or a demonstration of the capabilities by viewing training modules.

2.4.1.3 Discuss the training program flexibility and recommended strategies to allow the State to maximize the benefit of your training offerings. Include best practices or strategies effectively deployed by other customers using your catalog of products (e.g. - a monthly schedule, targeted programs at specific audiences, etc.).

2.4.1.4 Describe clearly the administrative burdens that will be required by the State of Indiana to deliver the training to 32,000 workers. Set expectations for the number of administrators needed, the percentage of their time needed, the expertise required, and other aspects of administration. Differentiate the work required by the State for administering SCORM modules compared to those needed if the State opts to use a hosted solution or a hybrid of the two. Make known options for the training to be offered via different plans/schedules on an agency by agency basis if available.

2.4.1.5 Describe the reports, dashboards and other management tools available to measure the State’s training performance. The State is comprised of multiple business units and a capability to break the results down granularly would be beneficial (discuss the granularity the state might expect to see from these tools).

2.4.1.6 Discuss the “trainee” interface with your product. Understanding the SCORM modules would be delivered by the State’s PeopleSoft ELM, explain the end user experience our employees will encounter. If the State uses your hosted solution, discuss the methods state workers will encounter when accessing to access the training and any technologies employed to make the training easy and intuitive

Technical Proposal Page 1 of 3 for workers (e.g. – notifications, late notices, training navigation, training resumption after interruption, etc.).

2.4.1.7 Discuss any technical requirements required for workers to take the training (e.g. – workstation software, browsers and any browser configuration requirements, bandwidth).

2.4.1.8 Describe the support options provided to customers. Differentiate between optional and standard offerings. Discuss the interfaces to employees, integration with the State’s help desk, etc. If not discussed elsewhere, describe the support offered to State training administrators in regard to problems (other than user errors), configuration changes, user database administration, etc.

2.4.1.9 Discuss anything of importance to the State’s understanding of your product that has not been addressed in the requests above. These can include differentiators between you and your competition, product capabilities, administrative or support benefits, or other information that makes the case for your offering.

2.4.2 PHISHING TRAINING Please address the following questions on the phishing training.

2.4.2.1 Explain the capabilities of your phishing simulation system in terms of a library of content. Discuss the out of box capabilities, customization opportunities, the method and timing for updating content and message templates, library of templates/messages, etc.

2.4.2.2 Discuss how your product is effectively used to improve recognition of phishing messages. Identify the flexibility that the state can leverage to improve its environment based on your experience with customers that have deployed your product.

2.4.2.3 Describe a recommended program for a state with 32,000 workers. Explain recommendations for maximizing the benefit and effectiveness of your phishing simulation program (e.g. – frequency, combining with other training aids, targeting certain job classifications, directing failures to training, etc.) and how these are implemented. Discuss any ongoing value you provide to the state (e.g. – consulting based on results) throughout the contract that improve results.

2.4.2.4 Discuss the administrative requirements for a successful implementation and ongoing operation of phishing simulations. If there are options of your company or a trusted third party delivering this as a service rather than direct State administration, elaborate on what would be involved.

2.4.2.5 Describe the reports, dashboards and other management tools available to measure the State’s phishing simulation performance. The State is comprised of multiple business units and a capability to break the results down granularly would be beneficial (discuss the granularity the state might expect to see from these tools). 2.4.2.6 Describe the support options provided to customers. Differentiate between optional and standard offerings. Discuss the interfaces to employees, integration with the State’s help desk, etc. If not discussed elsewhere, describe the support offered to State training administrators in regard to problems (other than user errors), configuration changes, user database administration, etc.

2.4.2.7 Discuss anything of importance to the State’s understanding of your product that has not been addressed in the requests above. These can include, differentiators between you and your competition, product capabilities, administrative or support benefits, or other information that makes the case for your offering.

2.4.3 COMBINED TRAINING Please address any synergies gained by using the cyber security training modules in conjunction with the phishing training.

2.4.3.1 For respondents providing quotes on both the cyber security awareness program and the phishing simulation discuss the benefits of such a combination versus two standalone solutions (best of breed).

2.4.3.2 Discuss the non-training benefits of combining the two needs with a single provider (e.g. - business, administration, and other advantages).

2.4.4 ASSISTIVE TECHNOLOGY

2.4.4.1 Validate that the application conforms to the Assistive Technology Policy (Section 508). This should be done by submitting a Voluntary Product Accessibility Template (VPAT) if already available or completing the Assistive Technology Compliance Evaluation Form (Attachment H) that should be an attachment to the RFP.

Technical Proposal Page 3 of 3