202-20250417081843 SCSD.pdf

Bid 2425-04

SIMPSON COUNTY SCHOOL DISTRICT

NOTICE TO BIDDERS

INVITATION FOR BIDS

111 EDUCATION LANE

MENDENHALL, MISSISSIPPI 39114

TELEPHONE

(601) 847-8000

The Simpson County School District will accept bids until 2:00 P.M. THURSDAY, MAY 29, , at the Administrative Office Building of the Simpson County School District, located at 111 Education Lane, Mendenhall, Mississippi 39114, at which time said bids for the purchase of the following item(s) will be publicly opened, read aloud and taken under advisement:

BID #2425-04 Endpoint Detection and Response (EDR)

Bids will be awarded or rejected by the Simpson County School Board at 5:00 p.m. on THURSDAY, June 12, 2025, or as soon thereafter as conveniently possible. The Board meeting will be held at 111 Education Lane, Mendenhall, Mississippi 39114.

Items required, specifications, and bid forms may be obtained via the following web address:

https://bit.ly/3k6PI1g. You may also obtain the documents in person at the Administrative Office Building of the Simpson County School District, located at 111 Education Lane, Mendenhall, Mississippi.

Electronic bids should be submitted through the following email address: bids@simpson.k12.ms.us.

The Simpson County School District reserves the right to reject any and/or all bids or any groups thereof and waive any defect or informality in any bid or bidding procedure.

Inquiries regarding this bid should be directed to Kristi Magee at the following email address:

kmagee@simpson.k12.ms.us. Emails must be marked “SIMPSON COUNTY SCHOOL DISTRICT ENDPOINT DETECTION AND RESPONSE (EDR) 2425-04” in the subject. All bidders can view all Q&A on the bid web site.

INTRODUCTION

Simpson County School District is seeking proposals from qualified vendors to provide Endpoint Detection and Response (EDR) services. The selected vendor will be responsible for providing real-time monitoring, threat detection, investigation, and response capabilities for all network endpoints (e.g., desktops, laptops, servers, mobile devices).

Omissions in the proposal of any provision herein described shall not be construed as to relieve the vendor of any responsibility or obligation to the complete and satisfactory delivery, operation and support of any services.

Should the vendor have questions or find discrepancies in, or omissions from, this Bid or shall be in doubt to its meaning, the vendor shall at once notify the Simpson County School District. All questions should be addressed to Kristi Magee at the following email address:

kmagee@simpson.k12.ms.us. All bidders can view all Q&A on the bid web site.

BID CALENDAR

BID NUMBER 2425-04

Bid Publication April 17, 2025

Bid Publication April 24, 2025

Last day for Questions May 28, 2025

Bid Opening May 29, 2025

Recommendation to SCSD Board June 12, 2025

VENDOR BID INSTRUCTIONS

A-1 - DELIVERY OF BIDS:

1. The Simpson County Board of Education will receive sealed, competitive bids in the Off ice of the Director of

Technology, Administrative Of f ice Building of the Simpson County School District, 111 Education Lane, Mendenhall, Mississippi, as per the date and time specif ied on page 1, at which time the bids will be publicly opened, read aloud and taken under advisement.

2. The Bid Proposal form must be received on or before said date and time, neither the dating of the Bid Proposal form nor placing it in the mail by this date will meet the requirements pertaining to this bid. Any bid received af ter the bid opening date shall be marked "LATE BID" and returned to the Bidder unopened.

3. The district will not be responsible for any delays in delivery. It is the sole responsibility of the Bidder that bid proposals reach the above destination by the bid opening date and time.

4. Bids or alterations by fax or telephone WILL NOT be accepted.

5. If the Simpson County School District Administrative Of f ice Building is closed for any reason, including but not limited to: acts of God, strikes, lockouts, riots, acts of war, epidemics, governmental regulations superimposed af ter the fact, f ire, earthquakes, f loods or other natural disasters (the “Force Majeure Events”), which closure prevents the opening of bids at the advertised date and time, all bids received shall be publicly opened and read aloud on the next business day that the district shall be open and at the previously advertised time. The new date and time of the bid opening, as determined in accordance with this paragraph, shall not be advertised, and all Vendors/Contractors, upon submission of a bid proposal shall be deemed to have knowledge of and shall have agreed to the provisions of this paragraph. Bids shall be received by the district shall not be held responsible for the receipt of any bids for which the delivery was attempted and failed due to the closure of the district of f ices as a result of a Force Majeure Event. Each Vendor/Contractor shall be required to ensure the delivery and receipt of its bid by the district prior to the new date and time of the bid opening.

A-2 - PRICES:

1. Bid prices, unless otherwise specif ied, shall be net, including transportation and handling charges fully prepaid by the Bidder.

2. All bids must be f irm prices, f ree of any escalator clauses.

3. Prices should include any and all applicable taxes, as Simpson County School District is a tax-exempt governing authority, tax exemption letter furnished upon request.

4. While it is the intention of the Simpson County Board of Education to purchase the specif ied quantities, the right is reserved to accept bids on the basis of individual line item or by total bid price whichever is deemed to provide the maximum benef it to the district. The right is also reserved to omit any item or reduce quantities as necessary to bring the total cost within budgetary provisions.

5. Any bid on any item should include a unit price and an extended price if requested on the Bid Proposal form. If there is any discrepancy between the unit price written in the bid and the total price extension, the unit price will be considered as binding, and the extended price will be adjusted accordingly.

A-3 - BID ADDENDUM:

1. Any interpretation of the documents will be made by written addendum only and issued by the of f ice of the Director of Technology. Copy of such addendum will be posted on the bid website. The district will not be responsible for any other explanation of the proposed document.

2. As per Mississippi Code of 1972, as amended; Section 31-7-13, Bid requirements and exceptions; (iv) No addendum to bid specif ications may be issued within two (2) working days unless such addendum also amends the bid opening date to a date not less than f ive (5) working days af ter the date of the addendum.

A-4 - PROPER EXECUTION

1. All bids must be submitted in accordance with Section 31-7-13 of Mississippi Code of 1972 as amended, and must be properly executed and signed by a responsible of f icer or employee of the Bidder.

2. All bids must be typed or written (legibly) in ink. Any alterations or changes that are made must be done in ink and initialized by the person who signs the Bid Proposal form.

3. Bids should be checked before submission for accuracy and correctness since the Simpson County Board of Education WILL NOT be responsible for any errors for which the Bidder is responsible.

4. The district reserves the right to reject bids f rom Bidders who submit incomplete bids that do not specifically adhere to the bid instructions herein.

5. To prevent opening by unauthorized individuals, it is required that mailed Bid Proposal forms be delivered in an envelope clearly marked in the lower lef t-hand corner with the following information:

DATE: (date the bid is submitted) DUE: (date the bid is due) BID NUMBER: (on bid documents) BIDDERS NAME: (company/full name)

A-5 - CERTIFICATION OF INDEPENDENT PRICE DETERMINATION:

By signing the BID PROPOSAL FORM the Bidder certif ies, in connection with procurement, that to the best of their knowledge and belief :

1. The prices in the BID PROPOSAL FORM have been arrived at independently, without consultation, communication, or agreement, for the purpose of restricting competition; as to any matter relating to such prices with any other Vendor or Bidder.

2. Unless otherwise required by law, the prices have not been knowingly disclosed by the Bidder and will not knowingly be disclosed by the Bidder prior to the Bid Opening Date and Time specif ied on page 1 of the BID INSTRUCTIONS, directly or indirectly with any other Vendor or Bidder.

3. No attempt has been made or will be made by the Bidder to induce any other Person or Bidder to submit or not to submit a BID PROPOSAL for the purpose of restricting competition.

A-6 - BID WITHDRAWAL and MODIFICATION:

1. Bids may be modif ied or withdrawn by written notice f rom or in person by the Bidder, if received in the Office of the Director of Technology, two (2) working days prior to the stated bid opening date and time on page 1 of the

BID INSTRUCTIONS.

2. No withdrawals will be accepted by telephone, fax or email.

3. If a Bidder withdraws his bid, all documents shall remain in the possession of the Simpson County Board of

Education, marked as withdrawn, and included in the permanent f ile of that bid item.

4. No bids shall be withdrawn for a period of thirty (30) days following the bid opening date, unless otherwise provided for by law.

A-7 - BID OPENING:

1. All bid openings are open to the public. The Simpson County School District staf f will read a summary of each

Bidder's proposal and answer questions to the extent possible at the time. Any information provided in the bid which contains trade secrets or conf idential commercial or f inancial information and which Bidder does not wish to be disclosed other than for purposes of evaluating it must be clearly labeled on each sheet as conf idential.

2. All disclosures of bid information to interested parties will be made in compliance with Simpson County School District policies and procedures established in accordance with the Mississippi Public Records Act of 1983 def ined in Section 25-61 of the Mississippi Code.

A-8 - RIGHT TO REJECT BIDS:

The Simpson County Board of Education reserves the right to reject any and/or all bids or any groups thereof and waive any defect or informality in any bid or bidding procedure.

A-9 - BID ACCEPTANCE:

1. If the Simpson County School District accepts a bid in response to this request, it will accept the bid of and award the bid to the lowest and best responsive Bidder meeting specif ications, price and other factors considered. The low bid is not always the best bid. Other factors to be considered include, but are not limited to:

conformity to the specif ications; quality; Bidder's ability to provide service, maintenance, and training; past performance of Bidder; f inancial standing and status of the Bidder.

2. Unless otherwise stated in the BID SPECIFICATIONS all bids shall be binding for a minimum of thirty (30) days following the acceptance of the bid by the Simpson County Board of Education.

3. Acceptance of any proposal and the subsequent issuance of a contract is contingent upon the availability of sufficient funding. Simpson County School District reserves the right to withdraw, reject, or delay the acceptance of any proposal if adequate funding is not secured.

4. Award may be dependent upon products and services eligible for reimbursement through, and approved by, the federal E‐Rate program. If applicable, the selected vendor should participate with the USAC E‐ Rate program, have a valid SPIN and SPAC number as provided by the Schools and

Libraries Division of USAC, and itemize and separate products and services eligible for E‐Rate reimbursement from those not eligible. More information on USF eligibility and SLD guidelines can be found at the following website: http://www.usac.org.

A-10 E-RATE REQUIREMENTS:

1. The vendor must have a valid E-RATE SPIN (Service Provider Identification Number)

2. The vendor must have a valid Service Provider Annual Certification (SPAC) filed with USAC. See the

E-RATE program details at www.usac.org/e-rate

3. The District will leverage CYBERSECURITY PILOT PROGRAM funding and will be using the SPI invoicing method.

4. Goods and services provided shall be clearly designated as CYBERSECURITY PILOT PROGRAM

Eligible. Non-eligible goods and services shall be clearly identified as 100% non-eligible.

5. Service providers must comply with the FCC rules for Lowest Corresponding Price (LCP).

B Service Provider Responsibilities under SPI Reimbursement:

1. Accurate and Complete Invoicing: Service providers must submit invoices that detail both the discounted and non-discounted amounts. The invoice should include the appropriate Cybersecurity Pilot Program funding request number (FRN), applicant’s billed amount, and the total discount applied. Simpson County School District’s discount rate is 90%.

2. Coordination with the Applicant: The service provider must work closely with the applicant to confirm the correct discount rate and billing amount. Any discrepancies between the discount applied by USAC and the provider’s invoice should be promptly addressed.

3. Invoice Filing Period: Invoices for SPI reimbursement must be submitted to USAC within the required number of days from the date of service delivery (as per the Cybersecurity Pilot Program), or as otherwise specified by USAC.

4. Verification of Cybersecurity Pilot Program Discount: Service providers must verify the Cybersecurity Pilot Program discount applied to each applicant and ensure it matches the eligibility details reflected in the approved Form 471 and Form 486.

5. Audit Requirements: The service provider must be prepared for audits or reviews by USAC to verify that SPI reimbursements have been correctly invoiced and that services were provided according to the approved funding requests.

6. Record Retention: Service providers must retain all records related to SPI reimbursements for a minimum of ten years from the last date of service delivery under the contract, as required by USAC.

7. Compliance with Program Rules: Service providers are expected to fully comply with all applicable Cybersecurity Pilot Program rules and regulations. Failure to do so may result in disqualification from the program and the inability to receive future reimbursements.

B-2 – CONTRACT PERIOD

1. The Contract shall cover the period f rom July 1, 2025, through June 30, 2028.

2. The Contract may be renewed at the expiration of the initial term at the request of the District. The renewal may be for up to three (3) additional one (1) year periods. Any renewal shall be based on the same terms and conditions as the initial term with the exception of the price or rates. Initial prices or rates and subsequent renewal prices or rates are guaranteed for a minimum of twelve (12) months. Any increase in prices or rates af ter the initial term or any renewal term shall be limited to the prior year’s increase in the Consumer Price Index for Urban Wage Earners (CPI-W). All price increases must be approved by the Simpson County School District prior to a renewal.

3. Notice of intent to renew will be given to the Vendor(s) in writing normally sixty (60) days before the expiration date of the current term.

B-3 - BILLING/ORDERING

1. All invoices are due in the Administrative Of f ice Building of the Simpson County School District, 111 Education

Lane, Mendenhall, Mississippi 39114, on or before the last day of each month. If they are not received by that date payment will not be made until the following month.

2. Payment of above-described invoices shall be on the 2nd Thursday of each month.

3. No negotiations, decisions or actions shall be executed by any Bidder as a result of any discussions with any

District employee. Only transactions that are on a Simpson County School District purchase order may be considered of f icial.

B-4 - DAMAGE OR LOSS:

1. Any damage or loss to the Simpson County School Districts property or data as a result of any action by the successful Bidder in the execution or performance of any item or service in this bid, shall be repaired to the satisfaction of the Simpson County Board of Education, at the Bidders expense, within a reasonable time set forth by the Simpson County Board of Education.

2. The successful Bidder shall hold the Simpson County Board of Education, Simpson County School District, its Of f icers, Agents and Employees harmless f rom liability of any nature or kind whatsoever, because of use of by publisher or author, manufacturer or agent of any copyrighted or un-copyrighted composition, secret process, patented or unpatented invention, article, environment-sensitive material, or appliance furnished or used under this bid.

C. BID SPECIFICATIONS

Simpson County School District is seeking proposals from qualified vendors to provide Endpoint Detection and Response (EDR) services. The selected vendor will be responsible for providing real-time monitoring, threat detection, investigation, and response capabilities for all network endpoints (e.g., desktops, laptops, servers, mobile devices).

C-1. GENERAL SPECIFICATIONS:

1. Endpoint Protection:

a. The solution must provide continuous monitoring and protection for all endpoints, including but not limited to desktops, laptops, servers, and mobile devices.

b. Ability to detect and mitigate various types of threats, including malware, ransomware, viruses, phishing attacks, and other endpoint-based attacks.

c. Real-time detection and alerting for suspicious activities or anomalies based on predefined criteria and patterns.

2. Threat Detection and Analysis:

a. Must leverage advanced behavioral analytics, machine learning, and threat intelligence to detect both known and unknown threats.

b. Provide an advanced detection engine capable of identifying advanced persistent threats (APTs), fileless attacks, and zero-day threats.

c. Real-time alerting of potential threats with detailed context (e.g., affected endpoint, file names, IP addresses, timestamps, severity level).

3. Automated and Manual Incident Response:

a. The solution should automatically respond to certain threats based on severity (e.g., quarantine files, block IP addresses, isolate compromised endpoints).

b. Provide manual response options, enabling administrators to take control of incidents and perform actions such as terminating processes, rolling back system changes, and blocking or removing malicious files.

c. Incident response should include detailed logs for auditing purposes and post-incident analysis.

4. Forensic Investigation:

a. Provide the capability to investigate and perform forensic analysis of incidents, including detailed logs of endpoint activity.

b. Must offer a timeline of events and provide tools for tracing the origin of attacks, identifying lateral movement, and understanding the full scope of incidents.

c. Allow for deep querying and retrospective analysis to identify threats that may have been undetected in the past.

5. Endpoint Isolation and Containment:

a. Ability to isolate affected endpoints from the network immediately upon detection of a critical threat.

b. Ensure no communication between compromised endpoints and other network resources until the threat is fully neutralized.

6. Advanced Threat Hunting:

a. Provide proactive threat hunting capabilities to identify potential risks before they result in a breach or major incident.

b. Vendor should provide access to dedicated experts for hunting known and emerging threats and be able to investigate suspicious indicators of compromise (IoCs).

7. Threat Intelligence Integration:

a. Integration with global threat intelligence feeds to enhance the detection of new threats and zero-day attacks.

b. Correlation of endpoint data with external threat intelligence sources to improve detection and response capabilities.

8. Endpoint Visibility and Reporting:

a. Must provide a centralized dashboard that offers real-time visibility into endpoint activity, alerts, and ongoing investigations.

b. Reporting features should include customizable alerts, historical data, and executive summaries for management.

c. Ability to generate compliance reports for regulatory requirements such as CIPA, HIPAA, or FERPA, and for Cybersecurity Pilot Program funding documentation.

9. Compliance and Data Privacy:

a. The EDR solution must comply with applicable privacy and security regulations, including but not limited to GDPR, HIPAA, and FERPA, where applicable.

b. Vendor should be able to demonstrate how the solution aligns with regulatory compliance and Cybersecurity Pilot Program requirements.

10. Integration with Existing Systems:

a. The EDR solution should be capable of integrating with the organization’s existing security infrastructure, such as Security Information and Event Management (SIEM) systems, firewalls, and intrusion detection/prevention systems (IDS/IPS).

b. Ability to integrate with other security tools, including threat intelligence platforms and vulnerability management solutions.

11. Management and Maintenance:

a. The EDR solution should be managed and maintained by the vendor, including regular updates, patches, and ongoing optimization of detection capabilities.

b. Provide 24/7 support for critical incidents, with response time SLA commitments for different severity levels of alerts.

c. Clear escalation procedures should be in place for handling high-severity incidents or issues.

12. Deployment and Onboarding:

a. Provide a clear plan for deploying the EDR solution across all endpoints, including a timeline, and estimated timeframes for initial deployment and full coverage.

b. Assistance in initial configuration and onboarding of endpoints into the EDR platform.

c. Vendor should provide training for internal IT staff on how to use the EDR platform, respond to alerts, and perform basic investigations.

13. Scalability:

a. The EDR solution should be scalable to accommodate future growth, with the ability to easily add new endpoints or support increased traffic without degradation in performance.

b. Should provide flexibility for growing or changing IT environments, including expansion into new locations or departments.

14. Cost Structure:

a. Provide a detailed pricing breakdown, including:

a. Licensing costs per endpoint (annual or multi-year subscriptions).

b. Deployment and setup costs.

c. Ongoing support and maintenance fees.

d. Any additional costs for upgrades, integrations, or premium features.

15. Service Level Agreements (SLAs):

a. Clearly define SLAs for the following:

a. Detection time (how quickly the system should detect a threat).

b. Response time (how quickly a response should be initiated after a threat is detected).

c. Issue resolution time (how quickly issues are resolved based on severity).

b. Ensure vendor response time commitments for both routine and emergency support, including a clear escalation path.

Vendor Requirements:

• Experience and Expertise:

o Vendor should have proven experience in providing EDR solutions to organizations similar in size and scope to Simpson County School District.

o Provide at least two references from K-12 institutions or libraries currently using the proposed EDR solution.

• Certifications and Compliance:

o The vendor must hold relevant security certifications such as SOC 2, ISO 27001, and any industry-specific certifications.

o Demonstrated experience in adhering to Cybersecurity Pilot Program compliance and other relevant cybersecurity regulations.

C-2. EDR RFP Evaluation Rubric with Cybersecurity Pilot Program Funding

Criteria Weig ht Rating Scale (1-

5) Description

1.

Cybersecurity Pilot Program Compliance & Eligibility

10%

1 = Non-compliant to 5 = Fully compliant

Vendor’s ability to meet Cybersecurity Pilot Program funding rules, including their eligibility as a service provider (SPIN number), knowledge of E-Rate processes (Form 471, Form 486, Form 474), and adherence to the rules regarding funding requests and reimbursement.

2. Technical Expertise and Capabilities

10% 1 = Poor to 5 = Excellent

Vendor's technical proficiency in offering EDR services, including security monitoring, threat detection, incident response, and vulnerability management. How well the proposal aligns with the technical specifications and integration with the applicant's existing systems.

3. Service 10% 1 = Unclear or Evaluation of the vendor's proposed SLAs, including response times for threat detection, Level Agreements (SLAs) and Response Time inadequate to 5 = Very clear and robust incident response, and resolution. The clarity and comprehensiveness of the service level expectations (e.g., response and resolution times for critical incidents).

4. Experience and Past Performance

10%

1 = Limited experience to 5 = Extensive experience

The vendor’s experience with similar projects, particularly in educational or library environments. Past performance references and case studies showing successful EDR service delivery.

5. Cost and

Cybersecurity Pilot Program Alignment

25%

1 = Over budget or non-compliant to 5

= Well-aligned with Cybersecurity Pilot Program funding

The cost structure should be reasonable and within the scope of the Cybersecurity Pilot Program budget. The proposal should include a breakdown of costs that align with

Cybersecurity Pilot Program funding guidelines. The vendor must demonstrate an understanding of Cybersecurity Pilot Program billing procedures, including SPI (Service Provider Invoice) method and the applicant’s responsibility for non -discounted amounts.

6. Reporting and

Documentatio n

10% 1 = Inadequate to 5 =

Comprehensive

How well the vendor outlines their reporting and documentation process. This includes incident reports, vulnerability assessments, compliance reports, and the ability to generate reports required by Cybersecurity Pilot Program for audit and review.

7. Vendor Support and

Customer Service

10% 1 = Poor to 5 =

Excellent

Evaluation of the level of customer support provided, including the availability of 24/7 support, incident response handling, and access to a dedicated account manager.

8. Integration and Compatibility

10%

1 = Difficult integration to 5

= Seamless integration

The vendor’s ability to integrate their EDR services with existing infrastructure, such as

SIEM systems, firewalls, endpoint protection, and cloud services. Compatibility with Cybersecurity Pilot Program-related reporting and compliance systems.

9. Training and

Knowledge Transfer

5%

1 = No training to 5 = Extensive training

Evaluation of any offered training or knowledge transfer for internal IT staff to understand how to interact with the EDR service, respond to incidents, and use provided tools effectively.

Rating Scale:

• 1 = Poor: Fails to meet requirements or is unclear, with significant gaps in the proposal.

• 2 = Fair: Meets some requirements, but lacks clarity or may have some gaps in critical areas.

• 3 = Good: Meets most of the requirements, with only minor issues or gaps.

• 4 = Very Good: Meets the majority of requirements with clear, detailed information; minor improvements possible.

• 5 = Excellent: Exceeds expectations; fully meets or surpasses all requirements with comprehensive details and no noticeable gaps.

Budget Limitations:

The total budget available for this project is $124,318. Vendors are required to provide proposals that fall within this budget. Any proposals exceeding this amount will be disqualified unless prior approval is obtained from the purchasing entity.

Please provide a detailed breakdown of costs, including hardware, software, installation, and any ongoing maintenance or service fees. All pricing should be inclusive of applicable taxes, shipping, and handling costs.

BID PROPOSAL FORM

BID ITEM:

D-1 I/We propose to provide the services, more or less, as listed in this BID PROPOSAL FORM according to the specif ications as listed in this bid, at the indicated prices. I/We further agree not to request permission to withdraw our bid af ter the bids have been publicly opened.

D-2 I/We understand that this BID PROPOSAL FORM is to be signed and returned with our bid, and unless this has been done, our bids shall be considered incomplete and rejected.

D-3 I/We, the undersigned, do hereby understand and accept the conditions outlined in the BID INSTRUCTIONS and BID PROPOSAL FORMS of this of ficial bid process in submitting our sealed competitive quotations for the item(s) outlined under the BID SPECIFICATIONS section of this bid:

Firm / Bidders Name :

(Type or Print)

Signed :

Title :

Contact :

Address :

Telephone :

E-mail :

Date :

SIMPSON COUNTY SCHOOL DISTRICT

BID SUMMARY SHEET

Please summarize your bid on these bid pages. Provide any additional details as attachments. If bid does not meet these specif ications, it shall be the responsibility of the Bidder to explain any dif ferences.

ANY ADDITIONAL COSTS (detail below):