1-Questionnaire and Pricing Spreadsheet.xlsx
XLSX spreadsheet 78 KB Posted
- Attached to
- Managed Cybersecurity Services
- Solicitation number
- 26-13102
- Issued by
- St. Louis County, Missouri
About this file
This is a questionnaire and pricing spreadsheet for the Rockwood School District's Managed Cybersecurity Services RFP in Missouri. The district is soliciting proposals for comprehensive managed security services including managed detection and response (MDR), Security Information and Event Management (SIEM), 24/7 Security Operations Center (SOC) monitoring, and endpoint detection and response (EDR). A mandatory pre-bid meeting is scheduled for Friday, January 30th, 2026, at 9:00 AM CST via Zoom, with all interested vendors required to execute a Non-Disclosure Agreement (NDA) prior to attendance. NDAs must be submitted to Brenda Kirchhoefer by January 28, 2026, with the Zoom link to be sent by Brad Bell on January 29, 2026.
The questionnaire contains detailed evaluation sections across ten major categories covering general service offerings, staffing qualifications and ratios, endpoint protection capabilities, SIEM and data log analysis functionality, 24/7 SOC operations, integration requirements with existing security infrastructure, data visibility and reporting capabilities, processes and procedures, and pricing models. Vendors must address topics including machine learning and AI implementation, third-party partnerships, proprietary technology requirements, incident response obligations and liability, personnel certifications, threat detection methodologies, data retention policies, disaster recovery capabilities, and comprehensive cost structures including base pricing, recurring fees, multi-year discounts, consulting support hours, and fees for additional services such as incident response and digital forensics.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 3-Acknowledgment Form (RFB).pdf | ||
| 2-Form K-12CVAT-Lite-V3.0 (1).xlsx | XLSX spreadsheet | |
| 6-26-13102.docx | DOCX document | |
| 5-E-Verify.doc | DOC document | |
| 4-Anti-Discrimination Against Israel Affidavit.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Introduction
| Rockwood School District |
| Managed Security Services RFP |
Please answer all of the questions and provide the needed information for each tab within this spreadsheet. Each section will be reviewed and scored against a matrix to select the best solution for Rockwood's needs.
General
| Reference | Question | Response |
| General Question | ||
| 1.1 | Where is your company headquartered? Indicate how many security operation centers (SOCs) you have, and where each one is located. | |
| 1.2 | How many managed service detection and response K-12 education customers do you currently have? | |
| 1.3 | What types of Rockwood owned systems would you typically integrate with your managed detection and response services? | |
| 1.4 | Describe all documented policies, procedures and audit requirements that will ensure maintaining the privacy and confidentiality of Rockwood’s data from the data of your other customers. | |
| 1.5 | What is your approach to providing meaningful security metrics? Describe reports available in the portal that Rockwood can use to demonstrate security effectiveness and ROI. | |
| 1.6 | Describe how Rockwood’s data (including data generated by your company about security events and incidents affecting the Rockwood School District will be governed and protected in transit. | |
| 1.7 | What access to internal-auditing documentation will you provide if our auditors, customers or business partners require this documentation in support of legal, regulatory or contractual requirements? What is your process for requesting documentation? What are the time frames to which you will commit for producing documentation? | |
| 1.8 | Indicate the frequency of meetings or teleconferences to review performance, issues, threat environment and responses. Explain the types of analyst and account management support provided during those meetings. | |
| 1.9 | What other services do you offer (not specified in this RFP) that could be beneficial to increasing the security posture of our district? What additional fees would be associated with these services? | |
| 2 | How does your solution leverage machine learning and AI? What steps is your company taking to increase your effectiveness for preventing, detecting, and remediating threats? | |
| 2.1 | Name any third party partners used to deliver your services and explain what services they provide. | |
| 2.2 | List the primary tools used to deliver your services. Describe the function or service offering they support, and indicate whether they are proprietary, commercial, or open source, for example, log collection, log management and storage, analytics, reporting, case management and workflow, and incident response. | |
| 2.3 | Will your services require the use of proprietary technology that the Rockwood School District must purchase or install? If so, please list all pertinent information related to this technology, including hardware, software, networking, middleware and database requirements. Include any associated costs as a separate line item in your quote. | |
| 2.4 | Describe the capabilities of your services to monitor our firewall, intrusion detection system (IDS), intrusion prevention system (IPS), endpoint protection data, network logs, user directories (Active Directory), identity and access management systems and vulnerability data | |
| 2.5 | If a security incident occurs while under contract, what role/obligation do you have to remediate any issues incurred by the Rockwood School District? Does your company provide any guarantees against a security incident while under contract? Is there any financial liability incurred by your company in this instance? |
Staffing
| Reference | Question | Response |
| General Question | ||
| 1.1 | Please describe what personnel would be responsible for managing the services specified in this RFP. How many dedicated staff would be assigned to Rockwood? | |
| 1.2 | Does your organization typically subcontract staff or do you maintain internal resources to meet the needs of your clients? If you subcontract, what contingencies do you put in place to ensure sufficient resources are available at all times during the contract? | |
| 1.3 | What is the ratio of monitored security devices to personnel? | |
| 1.4 | Provide a sample job description and/or resume for your security-monitoring staff. Include a summary of the technical expertise and/or special capabilities required. | |
| 1.5 | Explain the process of initial and ongoing training of your security-monitoring staff. | |
| 1.6 | What certifications/qualifications do the staff that will be providing our managed seciurity services possess? What ongoing education/training is required for these staff members? |
Endpoint Protection
| Reference | Question | Response |
| 1.1 | What endpoint protection products does your solution support? | |
| 1.2 | Describe your process and the level of support the Rockwood School District would receive from having your company manage our endpoint (EDR) solution? What would be the Rockwood Technology Department's role in remediating threats? | |
| 1.3 | If a threat was detected via our EDR solution, what is your guaranteed SLA for action to be taken on a discovered threat? | |
| 1.4 | Describe any specific endpoint behavior analysis and/or endpoint forensics features, capabilities or offerings to detect advanced, targeted attacks. | |
| 1.5 | What role will your company play in tuning rules and alerts within our endpoint protection product? What would the process of tuning rules and alerts look like? | |
| 1.6 | Are there any specific device configurations required for your service? If yes, please elaborate. |
SIEM and Data Log Analysis
| Reference | Question | Response |
| 1.1 | The Rockwood School District does not currently have a SIEM. What SIEM solution will you use in your managed services proposal? | |
| 1.2 | What are the advantages of your SIEM solution? |
1.3 Explain if/how you leverage big data platforms for the collection, retention and analysis of large volumes of operational and security data for analysis.
| 1.4 | How would your SIEM interact with existing security products within the Rockwood School District? |
| 1.5 | What sources of data and/or network telemetry would need to be provided by the Rockwood School District to implement your SIEM solution at high fidelity? |
| 1.6 | Will all of our raw event logs and data be collected and forwarded to your platform for storage? If no, describe the variation and options for full log event retention (if applicable). |
1.7 Provide details on your methodology for collecting and analyzing vulnerability and asset data (e.g., configuration) from all sources in scope.
1.8 Describe the process by which vulnerabilities are triaged and prioritized prior to reporting, including the integration of previous scan results and actions carried out. Is the vulnerability management (VM) data also used in the same fashion for MDR services, if applicable?
1.9 How will our logs be protected during transmission and when at rest?
2 Describe how Rockwood Technology staff will be able to access, search and browse our log data within your SIEM solution. Describe how Rockwood Technology staff would be able to create and modify reports from our log data collected within your SIEM.
| 2.1 | Describe the process by which data would be transferred from Rockwood to your SIEM solution. What security measures are put in place to ensure the safefy of this data? |
| 2.2 | How long will logs be retained? |
24-7 SOC
| Reference | Question | Response |
| 1.1 | What are the advantages to your SOC solution? What separates your company’s solution from your competitors? | |
| 1.2 | Describe the protocols your SOC solution would use when an active threat is discovered? Include a typical workflow that describes all the steps used from the identification of the threat to remediation. | |
| 1.3 | Please provide an example of how your services detected and addressed a recent security incident. | |
| 1.4 | Describe the protocols your SOC solution would use when IOC are located within our network environment? | |
| 1.5 | Have you provided SOC services to other K-12 school districts? If so, please list 1-3 below as a reference. | |
| 1.6 | Do you own and manage your SOCs? Where are they located? |
| 1.7 | Describe your available levels of SOC redundancy. |
| 1.8 | Describe the safety procedures and safeguards around your SOCs. |
1.9 How do you limit service interruptions if a SOC goes offline?
| 2 | Explain your process for proactively threat hunting to protect your customers. What types of analytics and methodologies are used to hunt threats? |
| 2.1 | How do you profile and monitor entity and user activities and behaviors (e.g., user and entity behavior analytics [UEBA])? |
| 2.2 | Describe any specific network monitoring and/or network forensics features, capabilities or offerings to detect advanced, targeted attacks. |
| 2.3 | Explain your methodology for detecting custom or targeted attacks directed at our users or systems. |
| 2.4 | What mechanisms would you use to detect for use of zero-day exploits or ransomware infections? |
| 2.5 | Explain your methodology for reducing false positives and false negatives and for classifying security-related events that represent a risk to the Rockwood School District. What is your false positive rate? |
Integrations
| Reference | Question | Response |
| 1.1 | What firewall appliances does your service support? | |
| 1.2 | Describe how your services integrate in data from Google Workspace. How would your service monitor our Google Workspace environment? | |
| 1.3 | Describe integration capabilities with enterprise directories, and configuration management databases (CMDBs). Explain how these integrations support the delivery of your services. | |
| 1.4 | Describe any integration capabilities with third-party service desk and ticketing tools and services. How is this achieved (e.g., email, application programming interfaces [APIs], etc.)? |
Do these types of integrations have an additional cost?
| 1.5 | What EDR solutions does your service support? |
| 1.6 | Will appliances be required to be installed in our environment? If yes, please elaborate. |
Data and Reporting
| Reference | Question | Response |
| 1.1 | How do you make data visible to your customers? If a software dashboard is used, please describe its setup, provide sample screenshots, etc. Can this dashboard be modified by Rockwood? | |
| 1.2 | How does the portal/dashboard provide us access to external threat intelligence feeds, in addition to Rockwood's own threat intelligence feeds? | |
| 1.3 | Describe the types of reports your solution can generate. Do you have the ability to do asset based reporting? | |
| 1.4 | Explain the capabilities for our staff to create customized, ad hoc queries and reports. Describe any limitations to ad hoc query or report generation, including data sources, data age and query frequency. Provide the timeframe for turnaround of ad-hoc reporting. | |
| 1.5 | Can data feeds from additional partners be integrated into our portal/dashboard? If so, are there any limitations to this feature? | |
| 1.6 | Describe how user access to data and reports can be restricted based on role and group. | |
| 1.7 | What Rockwood data will be collected/captured by your managed service. Where is that information stored? How is the information backed up and where is it typically stored? Please Detail use of hot sites, warm sites, or cold sites, as well as your disaster recovery capabilities. | |
| 1.8 | What are your standard data retention policies and what is your ability to modify them to meet our requirements? | |
| 1.9 | How much data is typically retained by your managed detection and response systems? |
Is there a maximum for data storage? How many days is data retained?
| 2 | Please describe your data retention policy and how it will apply to data provided by the Rockwood School District. |
| 2.1 | Provide details on your methodology for collecting and analyzing vulnerability and asset data (e.g., configuration) from all sources in scope. |
| 2.2 | Explain how you use external data (e.g., threat intelligence feeds) to analyze potential threats to Rockwood's environment, and describe what access to this data Rockwood will have. |
Processes and Procedures
| Reference | Question | Response |
| 1.1 | How will threats to our network be handled with your managed services solution? What will the process be for notifying Rockwood designated personnel of an issue/potential issue? What method of communication would be used in this situation? Who would be responsible for remediating the threat? | |
| 1.2 | Explain your methodology for detecting unknown threats. | |
| 1.3 | Explain how you will complete an initial assessment, and how you will establish a baseline security level. | |
| 1.4 | Describe your project management plan for onboarding the Rockwood School District onto your managed services solution. Provide a timeline that outlines the implementation plan with specific target objectives and tentative timelines for each objective. Who would be our primary point of contact during the implementation process? | |
| 1.5 | How would you report your performance in terms of the agreed upon SLA? | |
| 1.6 | Indicate device/agent management and real-time event management notification service levels. Explain how they are measured, and how they will be communicated to the Rockwood School District Technology Department. | |
| 1.7 | Describe the process for adding services or new technologies. For example, if we acquire new assets, adopt a new cloud application, or make architectural changes to the environment — how would this be supported and incorporated into an SLA? | |
| 1.8 | Describe your problem resolution and escalation procedures. |
Pricing
| Reference | Question | Response |
| 1.1 | What is the pricing model for your managed service solution? Provide the base cost and pricing methodology. | |
| 1.2 | Indicate and describe the pricing model for managing/monitoring virtualized security devices or log sources. | |
| 1.3 | Please indicate details on the number of devices or data sources (e.g., IDS sensors, firewalls and servers) that are included in the cost. |
Is pricing differentiated according to the sophistication of analytics used? If so, please describe the different tiers of pricing.
| 1.4 | Describe what recurring costs will be involved with your service. Is there any discounted pricing for multi-year contracts or bundling of services? What one time costs would occur with your solution? |
| 1.5 | If price is differentiated by different service tiers, please describe each tier, what is included in it, and what the cost would be. |
| 1.6 | Are there any additional fees for incident response support or digital forensics services? |
What digital forensics services do you offer a la carte and what fees are associate with this service?
| 1.7 | What is the process for adding additional devices and/or data services to the contract? What costs would be incurred by these additions? |
| 1.8 | Does the contract include any consulting support hours? If not or if additional hours are needed, indicate the price per hour/day for these consulting services |
| 1.9 | How would an increase or decrease in our technology infrastructure during the contract term affect contract costs? |
| 2 | Please provide pricing on the following components of a managed service. |
- Managed Endpoint Monitoring, Detection, and Remediation
- Managed SIEM Solution
- 24/7 SOC Service
Note: This may be broken down into each component or displayed as a flat rate for all the listed components.
File details come from the government source that posted it. Updated .