2-RFI 004-27 Mandaged Detection and Response Addenda 1.pdf

P a g e 1 | 12

September 11, 2026 Addendum #1: RFI-004-27 Temple ISD Managed Detection and Response (MDR)

Q). List any additional services, products, or systems not covered above (for example:

OT/SCADA platforms, remote field office connectivity, or industry-specific tools).

Required data retention period?

Example: 90 days, one year, 13 months or more A). None

Q). Do you need access to search your own data?

A.) Yes If yes, what hot data retention period is required?

14, 30, or 90 days A.) 30

Q/A). Microsoft 365?

In use? Yes Approximate user count. 1,500

Google Workspace? yes, 10,000 In use? Yes, Approximate user count Box? 1,000

Salesforce? No iManage Threat Manager? No

Q). Email Gateway vendor in use?

A). M365

Q/A). Servers in Azure? 0 Approximate count

Q/A). Servers in AWS? 0 Approximate count

Q/A). Servers in GCP? 0

Q). EDR vendor in use?

Example: Microsoft Defender, CrowdStrike, SentinelOne A). Cisco Secure Endpoint

Q/A). Number of direct internet egress points? 2

Q/A). Firewall setup at each egress point? Yes, HA

ie. Standalone or HA pair

Q). Physical interface between firewall(s) and core switch?

Example: 1Gb copper, 10Gb fiber, Twinax - A). 10Gb fiber.

Q). Internet circuit size at each egress point?

A). 10Gbps Example: 100 Mbps, 1 Gbps, 10 Gbps

Q/A). Number of on-premises servers? 100 Physical plus virtual

Q/A). Number of endpoints? 1500 Desktops plus laptops

Q). On-premises identity provider?

A). Active Directory Example: Active Directory

Q). Cloud-based identity provider?

A). Entra ID/Duo Example: Entra ID, Duo, Okta

Q). Number of users?

A). 1500 staff / 8800 students

Q).What is the anticipated service commencement date, and should respondents include incumbent overlap, transfer of runbooks and historical incident information, or migration of retained telemetry from Gradient Cyber?

A). Current contract ends March 2028

Q). Does the District expect the provider to take authorized containment actions directly, such as endpoint isolation or account disablement, or to provide recommendations for District personnel to execute? Please also identify any minimum severity-based response and notification targets.

A). Yes to authorized containment actions if District personnel cannot be contacted.

We are requesting information at this time

Q). What minimum number of annual IR-retainer hours should pricing include, and should respondents assume rollover rights, onsite response, travel expenses, breach-counsel or cyber-insurer coordination, and predefined rates for hours exceeding the retainer?

A). 20 per year

Q). Which existing Cisco products and licenses must the MDR provider directly integrate with, what API or administrative access will be available, and are there additional SIEM, firewall, email-security, cloud, or identity platforms in scope?

A). Cisco - Umbrella/Secure Endpoint/Identity Services Engine / Fortinet firewalls / Abnormal AI / M365 and GWS alert integrations

Q). Please provide the quantities and types of assets to be covered, including endpoints by operating system, servers, identities, network devices, cloud workloads, and any student devices, along with current or projected daily telemetry volume and retention requirements.

A). Windows devices and servers, Cisco network devices, Fortinet firewalls, no cloud workloads. Please provide information about your product offerings for review.

Q). Does Temple ISD have any minimum retention requirements for security telemetry, alerts, investigation records, or other event data? If so, please specify the required retention period and whether the data must remain immediately searchable or may be maintained in archival storage. Please confirm the expected daily ingest (in Gigabytes) expected for all of your telemetry.

A). 14 days

Q). What level of incident-response authority does Temple ISD anticipate delegating to the selected provider's 24x7x365 U.S.-based SOC? Specifically, may the SOC execute predefined containment actions under Temple ISD-approved incident-response playbooks, or must the provider obtain express authorization from designated Temple ISD personnel before taking containment action?

A). We currently leverage various methods of incident response based on the incident severity, including options asked about.

Q). Does Temple ISD require Cisco Secure Endpoint to remain the exclusive endpoint security platform, or may respondents propose a hybrid architecture that retains Cisco Secure Endpoint while deploying supplemental endpoint detection, forensic, or response technology on selected endpoints? If Temple ISD permits a hybrid architecture, may respondents identify the recommended deployment scope and associated pricing in their RFI response?

A). TISD is looking for information about any product offerings.

Q). Section 3 requires continuous threat detection, investigation, and response and incident coordination and response, while Section 4 identifies "containment recommendations." Please clarify whether the selected MDR provider will be expected to execute containment actions directly within Cisco Secure Endpoint, such as host isolation or process termination, or whether validated alerts, containment recommendations, and remediation guidance will satisfy Temple ISD's requirements.

A). Authorized containment actions if District personnel cannot be contacted.

Q). What evaluation criteria or weighting will the District use to compare RFP responses (e.g., price, technical capability, references, local presence)?

A). This is informational we are not weighing are ranking solutions. Once this goes to a request for proposal the evaluation criteria will be provided.

Q). Is TX-RAMP certification required or preferred for the MDR platform/vendor?

A). yes

Q). Are there specific compliance frameworks the MDR service must align with (e.g., TX-RAMP certification, CJIS, FERPA, NIST CSF)?

A). NIST

Q). Does the District have any current SIEM/SOAR platform in place, or is monitoring entirely delivered through Gradient Cyber's platform today?

A). gradient

Q). What is the approximate environment size (number of endpoints, users, sites) the MDR service needs to cover?

A). 1000 endpoint 1500 staff, 18 sites

Q). Are there other log sources (firewall, SIS/student data systems, email security, OT/building systems) the District expects included in MDR monitoring scope beyond the Cisco stack listed?

A). yes

Q). Does the District require the MDR provider to manage/tune the existing Cisco Secure Endpoint, Umbrella, ISE, and Duo tools directly, or only to ingest telemetry from them?

A). no

Q). Is Gradient Cyber's current IR Retainer and MDR contract still active, and if so, what is the expiration or renewal date?

A). yes march 2028

Q). Is the District open to responses from vendors offering MDR platforms other than Cisco-native solutions, provided integration with the existing Cisco Secure Endpoint, Umbrella, ISE, and Duo stack is demonstrated?

A).yes

Q). What does Temple ISD use currently for CyberSecurity?

A). Cisco and Gradient

Q). In addition to the listed core security technologies, does TISD have any of the following they would like to be included in the future state for MDR services:

Firewalls

Identity and Access Management (Entra ID, Okta, Active Directory)

Cloud security controls

Secure email gateways

Vulnerability management platforms

Other security devices or platforms A). Yes to all, provide information about your product/service capabilities.

Q). Does TISD have an existing SIEM and/or XDR platform license independent of the current MDR provider? And if yes, what is the platform?

A). No

Q). Does TISD expect the future MDR provider to supply the SIEM/XDR platform, or does TISD intend to provide the platform?

A). If TISD owns an existing SIEM/XDR platform, does the District expect the MDR provider to manage and administer it? No

Q). What firewall platforms and models are currently deployed within the TISD environment?

A). Fortinet

Q). Does TISD expect the MDR provider to manage and administer Cisco Secure Endpoint and any firewalls within scope, including configuration changes and security policy management, or is the provider's responsibility limited to monitoring and response?

A).Monitoring and response.

Q). What regular threat response services related to attacks and compromises of endpoints, identities, perimeter and other areas are currently provided by the MDR provider or expected of a new MDR provider?

A). Provide information about the capabilities of your platform.

Q). What are the expectations for "incident coordination and response services"? Does TISD desire the MDR provider to create tickets for internal resources to perform containment, eradication, recovery, and remediation, or would TISD like the MDR provider to perform some response services and coordinate others with internal resources?

A). Please provide information about the capabilities of your platform.

Q). The RFI references “containment recommendations.” Please clarify whether these recommendations are intended to be guidance for TISD personnel to execute, or whether TISD expects the MDR provider to have the ability to directly execute recommended containment actions.

A). Both.

Q). What is the expected scope of the Incident Response Retainer?

A). Provide information about the capabilities of your platform.

Q). How many hours of IR services does TISD currently maintain or expect under the retainer?

A). 80

Q). Does TISD expect remote forensic support to include advanced forensic activities such as disk, memory, or malware analysis?

A). Provide information about the capabilities of your platform.

Q). What frequency does TISD expect for proactive threat hunting activities?

A). Provide information about the capabilities of your platform.

Q). Does TISD currently use a ticketing or ITSM platform that the MDR service must integrate with?

A). No

Q). How frequently does TISD anticipate requiring tabletop exercises as part of the MDR service?

A). Provide information about the capabilities of your platform.

Q). Please clarify what types of security awareness support TISD is seeking as part of the MDR service.

A). Provide information about the capabilities of your platform.

Q). Please clarify the expected frequency and scope of executive cybersecurity briefings.

A). Bi-weekly or Monthly

Q). Regarding Service Level Agreements A). Provide information about the capabilities of your platform.

Q). Regarding the “US-based support” requirement, does TISD require all SOC monitoring and incident response personnel to be based in the United States, or would TISD consider a hybrid model with some services performed outside the U.S.?

A).Provide information about the capabilities of your platform.

Q). Does the US-based support requirement apply to SOC analysts only, or also to security engineers, technical account managers, and management personnel?

A).Provide information about the capabilities of your platform.

Q). What response-time targets does TISD expect for each incident severity level?

A). Provide information about the capabilities of your platform.

Q). What is the number of TISD staff and administration User’s?

A). 1500 staff, 20

Q). What is the number of TISD (non-student) endpoints to be monitored?

A). 1500

Q). What is the approximate number of servers and virtual machines within the intended MDR scope?

A). 100

Q). If available, what is the log ingestion volume for the current MDR provider in the

SIEM?

A). Not available at this time.

Q) Please provide a breakdown of the below devices:

A). Servers - 100 Linux - 0 Windows - 1500 Workstations - included in above number Firewalls - 3

Total no of sites for connectivity - 18 Total no of Network devices: Switches - 169 Routers - 2

Q) Would the District be interested in additional proactive services such as ransomware readiness assessments, attack surface monitoring, or vulnerability management?

A). Requesting information at this time, if you have more to add then do so.

Q). The RFI mentions pricing for 5 Years? Is this the base pricing with annual renewal pricing separately included after the base 5 years?

A). Yes

Q). Does the district have a budget allocated for this project?

A). This RFI is our first step to establishing the budget for this project.

Q). Does the District envision tabletop exercises being conducted solely with IT staff, or should vendors plan for executive leadership, legal, communications, and campus administration participation as well?

A). Present both options

Q). Will future evaluation criteria prioritize technical capabilities, K-12 experience, incident response expertise, Cisco ecosystem integration, pricing, or a combination of these factors?

A). Combination

Q). Since this RFI may inform a future competitive procurement, what capability gaps or service enhancements is the district hoping to improve upon compared to its current MDR provider?

A). Present current industry standards.

Q). What key performance indicators (KPIs) or service metrics are most important to the district for monthly operational reports and quarterly executive reviews?

A). MTTD, MTTR, Events investigated, event resolved, etc.

Q). Are there specific cybersecurity frameworks or compliance standards (CIS Controls, NIST CSF, Texas DIR guidance, K-12 Cybersecurity Act recommendations, etc.) that the district would like reporting and executive reviews mapped to?

A). NIST, TX DIR, K-12

Q). Will the current unused IR retainer hours roll over annually, and does the district expect proactive services such as compromise assessments to be included within those hours?

A). Present options for review and consideration.

Q). Does the District have a preferred number of annual Incident Response retainer hours, or should vendors propose recommended retainer levels based on K-12 industry best practices?

A). 80 hours

Q). Can the District share historical incident volume and severity trends to help vendors appropriately size SOC and incident response resources?

A). Not currently

Q). Does the District require active response capabilities such as endpoint isolation, account disabling, or network containment as part of the MDR service?

A). Yes

Q). What level of response authority does the district expect from the MDR provider during confirmed security incidents (notification only, recommended actions, or authorized containment actions)?

A). Depends on the severity of the incident. We have all 3 levels mentioned with existing services.

Q). Are there any additional security technologies currently deployed (SIEM, firewall, email security, cloud security platforms, Microsoft 365 security tools, etc.) that vendors should be prepared to integrate with?

A). Yes.

Q). Does the district have already existing SLA’s that are being leveraged? Can the vendor provide their own SLAs?

A). Provide options.

Q). Does the district have already existing SLA’s that are being leveraged? Can the vendor provide their own SLAs?

A). Provide options.

Q). Do you need SOAR capabilities enabled?

A). Provide information regarding these capabilities.

Q). Does any of the requirement need on site availability of personnel?

A). Please provide information about what your services can provide.

Q). How many total locations do you have and how are they connected today?

A). 18 locations, Fiber

Q). Does the district require Network Traffic Analysis (NTA)?

A). Please provide information about what your services can provide.

Q). Do you have infrastructure hosted in the cloud (AWS, Azure, GCP, etc.)?

A). No.

Q). What is the size of your IT Team?

A). We are looking for information about services provided network specifics can be discussed at a later time.

Q). How Many Log sources do you have today in the Network?

A). We are looking for information about services provided network specifics can be discussed at a later time.

Q). How many Network devices do you have in the Network?

A). We are looking for information about services provided, network specifics can be discussed at a later time.

Q). How many events (system events/syslog’s/FW logs, etc.) per second/day are we looking at? (EPS) A). We are looking for information about services provided, network specifics can be discussed at a later time.

Q). What Endpoint Detection & Response (EDR) solution do you use (if any)?

A). Secure Endpoint

Q). How many users are on the network?

A). 1500 staff / 8800 students

Q). What is your requirement for log retention?

A). At least 30 days

Q). Does the District intend to retain Cisco Secure Endpoint as the EDR of record and have the MDR provider monitor it, or is the District open to a provider-supplied EDR/XDR sensor replacing Cisco Secure Endpoint?

A). Open to replacing

Q). If a respondent proposes its own endpoint agent in place of Cisco Secure Endpoint, will that approach be evaluated favorably, neutrally, or considered non-responsive to the requirement for integration with the existing stack?

A). Neutrally

Q). For Cisco Umbrella, ISE, and Duo, is the requirement limited to log/telemetry ingestion and correlation, or does the District expect the MDR provider to actively manage, tune, and administer those platforms?

A). ingest and correlate

Q). Are the District's current Cisco security licenses under contract through a specific date, and would co-existence of the incumbent tooling and a new provider's sensor during a transition period be acceptable?

A). Under contract some overlap is to be expected

Q). Please provide total endpoint counts broken out by staff workstations, servers (physical and virtual), and student devices — including a specific count of Chromebook/ChromeOS devices, and confirmation of whether those devices are in scope for endpoint agent deployment.

A). Staff 1500, Servers 100, Mac 150, Chromebook 9000. Staff devices and servers are in the scope

Q). Please provide the operating system mix and versions in scope (Windows, macOS, Linux, iPadOS/iOS, ChromeOS), including approximate quantities by platform.

A). Windows 11, MacOS, Chrome OS, Windows Server 2016 and Up

Q). What log/telemetry retention period does the District require (in months or years), how much of that must be hot/searchable versus archived, and is retention expected to be included in the MDR service price?

A). 14 days hot and 60 archived

Q). Specification #11 references "containment recommendations." Does the District want the provider to have delegated authority to take active response actions — such as host isolation, process termination, or account disablement — or is the expectation advisory-only with all actions performed by District staff?

A). Currently a call is made before action is taken

Q). Will the District accept purchase through an existing cooperative or state contract vehicle (e.g., Texas DIR-TSO, BuyBoard, TIPS, Choice Partners, Region ESC, Sourcewell, E&I), or will any resulting award be made under a District-specific competitive solicitation?

A). yes and bidding will be done

Q).Should the RFI response be submitted by the manufacturer/OEM, by an authorized reseller/partner, or jointly? If an award is anticipated to a reseller, does the District have preferred or existing partners on contract?

A). Doesn’t matter at this point we are only looking for information

Q). Specification #32 requests five-year pricing. Is the District's intent a five-year firm-term agreement, or a one-year initial term with four optional annual renewals? Must pricing be firm and fixed for all five years, and should annual escalation be disclosed if applicable?

A). 5 year fixed

Q). When does the District's current MDR agreement with Gradient Cyber (and the associated IR Retainer) expire, and what is the District's targeted contract start date and service go-live date for a replacement or renewal?

A). March 2028

Q). What SIEM or log aggregation platform underlies the district's current MDR, and would historical log/event data be portable to a new provider, or lost?

A). Gradient, lost.

Q). : How many campuses or network segments would require independent sensor/appliance deployment, versus centralized monitoring from a single point?

A). 0.

Q). Is Cisco ISE currently deployed in monitor mode, low-impact mode, or closed mode, and does the district require a NAC policy continuity as part of any future MDR transition?

A). low impact, yes.

Q). Does the District's current Cisco Umbrella deployment include CIPA-compliant content filtering for student devices, and would that requirement carry forward as a scope item for MDR integration, or is content filtering managed separately from security monitoring?

A). Umbrella mirros our content filter

Q). What EDR/AV is currently deployed?

A). Secure Endpoints

Q). What Microsoft 365 licensing tier does the district currently hold and is it consistent across staff and student devices?

A). A3 Staff, A1 students

Q. Approximately how many endpoints are in scope for this engagement?

A). 1000

Q). Are there any non-Windows devices in scope for MDR monitoring?

A). yes

Q). Is there an expected start date and desired implementation timeline?

A). To be determined

Q).The RFI states that it is not a Request for Proposal, yet it references 'proposals' in describing the expected response. Please clarify which framing governs the submission: should respondents provide an informational response consistent with an RFI, or prepare a formal proposal as would be expected under an RFP?

A). This is a request for information; respondents should provide an informational response consistent with an RFI.

Q). Please confirm whether the Annual renewal pricing is beyond the initial five years.

A). The annual renewal will not extend beyond the initial five years.

Q). Will the City accept Incident Response (IR) Retainer services included in the MDR Services?

A). Yes, the city will accept IR retainer services included in the MDR services.

Q). How should the Incident Response (IR) Retainer be priced? For example:

a. Prepaid/Committed hours - You pay upfront for a block of hours (e.g., 40, 80, 100) at a set rate, drawn down as incidents occur.

b. Annual subscription/access fee - A flat yearly fee guarantees a defined response SLA (e.g., 2, 4, or 24 hours), sometimes with hours included and sometimes billed separately.

c. Zero-dollar/"$0" retainers - No upfront fee to secure a guaranteed response SLA, with services billed at a pre-negotiated rate only when used.

A). The IR retainer should be priced using, Prepaid/Committed hours - You pay upfront for a block of hours (e.g., 40, 80, 100) at a set rate, drawn down as incidents occur.

Q). May we submit Cost Specification assumptions in our response?

A). Yes, you may submit cost specification assumptions in your response.

Q). In addition to the Cost Specification, may we provide a rate card?

A). Yes, you may provide a rate card.

Q). Please provide the District's existing security technology stack to integrate with.

A). Please review the RFI for existing security technology stack to integrate with.

Q). What is the total number of Cloud VMs, e.g., total number of EC2 instances in AWS, GCP, Azure, etc.?

A). There is no Cloud VM's.

Q). What is the backend core switching speed (1GB, 10GB, 40GB, 100GB, etc.)?

A). The backend core switching speed is, 10GB between sites, 40GB between datacenters

Q). Are the data centers configured as Active/Active or Active/Backup?

A). The data centers are configured, Active/Active.

Q). Does all traffic go through data centers?

A). Yes, all traffic goes through data centers.

Q). What is the Internet Connectivity speed of each data center (100Mbps, 500Mbps, A). 1GBps, 10GBps, etc.)?

The total connectivity speed of each data center is 10GB.

Q). What is the total number of data centers?

A). The total number of data centers is 2.

Q). What is the total number of Windows, Linux, MacOS computers?

A). 1500 Windows, 150 Macs.

All other terms, conditions, and requirements of the original RFI remain the same.

Please sign and upload this document with your proposal.

Signatures: By signing this document, I agree that I have read and reviewed Addendum #1 RFI 004-27 Temple ISD Managed Detection and Response (MDR)

Name of Company: _____________________________________________

Representative Name: ___________________________________________

Signature: _____________________________________________________

Date________________________