3-Response to RFQ questions 8.31.2026.pdf

1. Section 3.2 lists "at least five years of organizational experience providing managed IT and cybersecurity services" as a minimum qualification. Could you clarify whether this may be satisfied through the collective professional experience of key personnel, and/or through a teaming or subcontracting arrangement with an established partner firm?

Response:

We prefer 5 years of experience providing these services as an organization. Please submit whatever experience you have in whatever arrangement or form and we will evaluate your submission based on what is submitted.

2. Section 3.2 also requires the ability to provide onsite support in Salt Lake County within the proposed service levels. Can onsite support be satisfied through a local subcontractor or partner rather than the prime OƯeror's own physical oƯice presence?

Onsite support cannot be satisfied through a local subcontractor or partner. It is our intent to create a close working relationship with a local provider.

3. The Section 5 schedule table lists the "Target onboarding / service start" date as January 1, 2026, which precedes the SOQ due date of September 15, 2026. Could you confirm whether this should read January 1, 2027?

The target service start date should be listed as January 1, 2027. The 2026 date was an error.

4. As far as discovery goes, will we be given access to do discovery on the network at KID before finalizing the RFQ, or is this simply indicating that those items will be required once we begin working together? I'm assuming the latter, but wanted to verify.

Access to do full network discovery will begin once we begin working together and have a contract in place.

5. Backups- Can we get additional information about the current system in place for backups, available hardware etc?

We have local backups on a redundant server, and a synology drive. A copy is pushed to a cloud platform daily.

6. Is there a copy of the current disaster recovery plan?

Yes. This will be made available to the selected provider of services, which they can use as a model or guide going forward.

7. Is there a current KID Incident response plan?

Yes. This will be made available to the selected provider of services, which they can use as a model or guide going forward.

8. Could the District clarify whether proposals and the separate fee schedule may be submitted electronically via email or a secure procurement portal instead of physical hard-copy mail?

In our RFQ we specified receipt of hard copy proposals by a specific date and time and ask that all submissions comply with that.

9. Can the District provide the current estimated inventory counts for managed physical servers, virtual servers, desktop/laptop workstations, mobile devices, and active network appliances (firewalls, switches, access points)?

Response:

Our business server infrastructure consists of two physical host servers configured as a redundant failover environment. The primary physical host runs nine virtual machines. A second physical host provides a duplicate/redundant environment capable of assuming those virtual server workloads in the event the primary host fails.

We have the same infrastructure for our SCADA. SCADA has a similar number of virtual machines running on them.

10. What is the total number of Microsoft 365 user licenses currently active, and what specific Microsoft licensing tiers (e.g., M365 Business Premium, E3, E5, GCC) are presently in place?

We have 32 MS 365 business premium user licenses.

11. What incumbent tools and platforms are currently deployed for RMM, EDR/MDR, centralized SIEM/log management, vulnerability scanning, and backup/disaster recovery?

Response:

We use widely used commercial software such as Sophos and Auvik, etc. We do not require or specify what must be used. We rely on the expertise of our IT/Cyber consultant to provide options and considerations in these areas.

12. Is the District seeking the Service Provider to provide and bundle all cybersecurity software licenses (EDR, MDR, SIEM, email security, vulnerability scanner) into the monthly service fee, or will KID procure licensing directly under its own agreements?

We prefer that the successful provider will bundle all licenses into their monthly services and fees. This includes annual support for servers, switches, renewal of domains, etc.

13. Regarding Section 2.7 (OT/SCADA Coordination), what specific SCADA software, hardware platforms, and communication protocols are currently utilized, and which third-party SCADA vendors maintain support agreements with KID?

We have a SCADA vendor who maintains all SCADA specific software and hardware with the exception of the actual SCADA host server. Our IT/Cyber consultant will maintain the host server environment and will work with them to provide network access and connectivity only. Our IT/Cyber consultant will work closely with them before making any changes to the SCADA host server hardware and software environment.

14. What is the current architecture and demarcation line between the District's enterprise IT network and the operational technology (OT/SCADA) network?

They are separate networks. They are physically separate and operate on separate network infrastructure, including separate host servers, switches, firewalls, etc.

15. Are there specific required onsite SLA response times for emergency (Critical / P1) and routine requests at the Kearns facility and remote well/pump station sites?

We don’t currently specify response times. All submissions will be evaluated and graded based on the submissions made by each vendor.

With regards to remote sites, currently the only involvement needed from our IT/Cyber vendor is help setting up and maintaining remote connectivity through cellular devices. This is very minimal and not mission critical. The main support provided by our IT/Cyber vendor will be at our oƯice and employees there.

16. How many distinct physical facilities or remote operational sites comprise the District's service territory that require network connectivity and potential onsite support?

We only have one oƯice where employees work. Our remote sites only require minimal help setting up and maintaining cellular connectivity on a very minimal basis.

17. What is the District's existing backup data volume in terabytes, and what are the current Target Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) for critical tier-1 applications?

We have 8-12 terabytes of data that is stored on redundant servers, backup drives and pushed to the cloud dailly. We do not specify any target times. All submissions will be judged and evaluated based on what target times you propose.

18. Is there currently an incumbent managed service provider delivering these services, or is this work currently managed internally or across multiple distinct vendor contracts?

Yes we do have an incumbent service provider providing all of this.

19. Regarding Section 3.3, if a Service Provider delivers 24/7 MDR/SOC and backup infrastructure directly through certified enterprise tools rather than third-party outsourced SOC vendors, what specific evidence or assurance documentation does the District prefer?

See response to question 25.

We have not specified specific SLAs. Your submission will be graded based on what you oƯer compared to others.

Non-US resources are not acceptable for SOC monitoring. All personnel responsible for SOC monitoring, security event analysis, incident response, or access to District systems and security data must be located within the United States. We will also give preference to local providers.

Having said that, we will evaluate your response based on responses from other providers. We rely on our IT/Cyber consultant to determine the best option and to provide assurance as to the veracity of their solution. We ask that it be explained clearly so that we may fairly evaluate it compared to others if they propose something diƯerent.

20. Will the District require personnel assigned to this contract to undergo specific background checks (e.g., Utah state background checks or CJIS-level screening) prior to accessing water/wastewater operational infrastructure?

Yes, but we put that responsibility on our provider to bear the burden and or cost of doing this before allowing personnel to work on our infrastructure.

21. For Section 2.4 (Penetration Testing and Cyber Audits), what is the expected scope (e.g., number of external IPs, internal subnets, web applications, or social engineering simulations) for the annual assessment?

We have completed cyber audits every 5 years, annual penetration testing, quarterly phishing, and monthly cyber training in the past. We welcome a robust proposal from our providers on what they recommend, as cyber protection is our top priority.

22. What specific compliance frameworks or reporting guidelines does the District currently utilize for EPA Risk and Resiliency Assessments and Emergency Response Plans?

We have applied the Security Controls listed in Appendix E of the Water Sector Cybersecurity Risk Management Guidance1(AWWA Guidance) document published by the American Water Works Association (AWWA) as the framework for this assessment. This framework includes 100 cyber-specific questions separated into 23 diƯerent cybersecurity categories. The USEPA (United States Environmental Protection Agency) recognizes four cybersecurity assessment frameworks as specifically applicable to the water sector and associates each with a diƯerent level of program maturity. The AWWA Security Controls used for this assessment represent the third level of maturity and are appropriate for organizations where cybersecurity is part of the culture and cybersecurity practices are sustainable over the long term.

The Cyber Security Evaluation Tool (CSET) designed by the federal Cybersecurity and Infrastructure Security Agency (CISA) was used to conduct this assessment.

The CSET tool includes modules for many diƯerent cybersecurity frameworks, including the AWWA Security Controls.

The responses recorded during the assessment are used as the basis for rating the protection elements defined in the ANSI/AWWA J100-21 Risk and Resilience Management of Water and Wastewater Systems2 (J100). This process ties the cyber risk assessment into the larger RRA eƯort. The assessment results also establish a cybersecurity baseline that can be used to track progress and improvements moving forward

23. What is the anticipated budget for this contract?

Budget is only a portion of this contract. We will first evaluate each submission without referring to the cost. Then we will look at costs and evaluate each by cost.

It is our experience that prices vary widely based on oƯerings. Because we are a government entity, we are very cost conscious. Please provide your best price with as much explanation and detail as possible so that we can fairly evaluate each based on price and what is being oƯered in return. Also provide detail on what items are optional and may be declined to reduce costs.

We anticipate that a large amount of the services provided will be cyber services and keeping all of our infrastructure up to date. With 32 users, and only 1 business and 1 SCADA server (each with redundancy) our day to day service needs are minimal because we like to keep our hardware infrastructure up to date.

We have found that properly maintained and updated servers, firewalls, switches, workstations, and other infrastructure is less expensive than down time and emergencies.

24. Is local Utah staƯ mandatory or can onsite support be provided through regional resources?

Onsite support cannot be satisfied through a local subcontractor or partner. It is our intent to create a close working relationship with a local provider.

See question 2 and our response to that above.

25. What are the expected onsite response SLAs? 3. Are non-US resources acceptable for SOC monitoring?

We have not specified specific SLAs. Your submission will be graded based on what you oƯer compared to others.

Non-US resources are not acceptable for SOC monitoring. All personnel responsible for SOC monitoring, security event analysis, incident response, or access to District systems and security data must be located within the United States. We will also give preference to local providers.

26. Are references from regulated industries acceptable if utility references are limited?

References from organizations similar in size, scope, and operating environment to the District are preferred, particularly other local government, water, wastewater, or utility organizations. However, references from other regulated industries may also be provided for consideration if they demonstrate comparable services, technical complexity, security requirements, and regulatory obligations.

27. Does KID expect penetration testing to be performed by the prime contractor or an approved subcontractor?

Response:

The District prefers penetration testing to be performed directly by the prime contractor. Use of a subcontractor would require prior written approval from the District, and the subcontractor would be subject to the same security, confidentiality, access-control, and data-handling requirements as the prime contractor.

28. Are you going to have the managed service provider choose the product or will that be done by yourself?

Response:

We have not specified any particular product or tool and will evaluate your submission compared to what others submit and our experience has been in the past with industry tools.

29. Under the 'Prepare Your Submission' section at the bottom left on the main page it says: "This Opportunity does not require Submissions". Is that because you require proposals to be physically mailed?

Response: In our RFQ we specified receipt of hard copy proposals by a specific date and time and ask that all submissions comply with that.

30. What line-of-business applications (e.g., billing/CIS, GIS, financial/ERP, engineering, records management) are currently in use, and are any of these hosted or managed by third-party vendors outside the scope of this RFQ?

As a local government utility provider we do utilize software tools that are typical for our industry. For example, we do bill our customers monthly, and we do map our infrastructure. We do design and install water and sewer infrastructure. We have administrative software, engineering software, operations software. Most are cloud based, but some are located on our physical servers. Our IT/Cyber provider will be expected to work with our third party software providers to ensure these tools function on our networks.

31. Is there a minimum expected onsite cadence (e.g., scheduled recurring visits), or is onsite support expected to be dispatch-based/as-needed only?

There is no minimum expected onsite cadence. It is up to our provider to propose what they believe works best for this including maintenance, planning, road mapping, etc.

32. Is there a current incumbent Managed IT/Cybersecurity provider, and if so, may the incumbent submit a response to this RFQ?

Yes, there is an incumbent provider and we fully expect them to submit a response to this RFQ. As a government entity in Utah, it is expected and often required that we go out to bid regularly for services. You may anticipate regular bidding regarding our IT/Cyber services in the future.

33. If an incumbent exists, are there known contractual constraints (e.g., notice periods) that would aƯect the transition timeline referenced in Section 2.1?

Yes, and all notices have been provided as specified in contract. If a transition to a new provider results from this RFQ, the incumbent is fully aware as they are familiar with government entities and purchasing requirements in Utah that we must comply with.

34. What is the current state of technical documentation (network diagrams, asset inventories, policies)? Should OƯerors assume existing documentation as a starting point, or plan for discovery from a limited-documentation baseline?

All technical documentation is up to date.

35. What SCADA/ICS platform(s) and PLC hardware are currently in use (vendor and model), and approximately how many PLCs and remote/field sites are connected to the SCADA environment?

The winning submission will be provided this information. Our third party SCADA provider will maintain all communications and PLCs/remote sites that are part of the environment. Our IT/Cyber provider will only be expected to support our third party SCADA provider through the design and maintenance of the network/server environment on which the SCADA network runs.

36. Is the OT/SCADA environment currently segmented from the District’s business IT network, and if so, can the District describe the current segmentation approach (e.g., firewalled DMZ, air-gapped, unidirectional gateway)?

Our SCADA is a separate network entirely. Separate servers, firewalls, DMZ, etc.

37. Who currently manages the SCADA environment day-to-day — District staƯ, a specialized SCADA integrator or vendor, or is this fully within the scope of this RFQ?

Our third party SCADA vendor manages our SCADA software and provide us technical support for operating the software. Our staƯ operate the software only.

Our IT/Cyber provider will design and maintain the separate network infrastructure only. They will work closely with our SCADA providers to maintain the SCADA network environment so that the SCADA software operates.

38. If a separate SCADA vendor manages the OT environment, will that vendor continue in that role, and what division of responsibility does the District anticipate between the QSP and the SCADA vendor under Section 2.7?

Our SCADA vendor will continue in their current role to maintain the software.

Our IT/Cyber provider will maintain the SCADA network infrastructure.

39. Has the District previously completed the EPA Risk and Resiliency Assessment referenced in Section 2.9? If so, can relevant findings or the resulting cybersecurity framework baseline be made available to OƯerors under a controlled due-diligence process, or to the awarded QSP post-award?

We have completed two EPA assessments. Relevant findings will be available post award only.

40. Does the District currently have cybersecurity tools in place (EDR, SIEM, email security, MFA, backup platform, etc.) that the awarded QSP would be expected to inherit and manage, or is the QSP expected to propose and implement a full tooling stack?

We do have a full spectrum of tools in place. The winning QSP will determine whether or not to continue with current tools or propose new solutions based on their expertise.

41. Section 2.4 lists penetration testing as part of the scope, but does not specify a breakdown. Can the District clarify its penetration testing requirements — including expected frequency or cadence (e.g., annual, per contract year), number of tests, scope by device/system/IP count, internal versus external testing, whether OT/SCADA systems are in scope, and whether testing must satisfy a specific compliance framework or cyber-insurance requirement?

Response:

We have not specified this level of service details, as we are relying on QSPs to demonstrate their expertise and experience in these areas by submitting a robust and thorough proposal.

42. Section 3.1.10 requires disclosure of “material cyber incidents relevant to service delivery.” Please confirm whether this requires the OƯeror to disclose its own incident history, the District’s incident history, or both.

This was referring to the QSP who was submitting a proposal for our consideration.

43. Does the District currently hold a cyber/privacy liability insurance policy, and if so, is there a specific carrier or policy structure the QSP would be expected to support through the insurance-questionnaire assistance referenced in Section 2.8?

Yes, and the insurance questionnaire is quite substantial and will require the QSP to respond in significant detail to the application.

44. Is the “optional cyber security audit/review” referenced in Section 2.4 intended to be priced as a separate, distinct line item from the core managed cybersecurity operations scope?

Yes. We would expect the QSP to recommend/oƯer these additional services as part of their relationship to the District.

45. Can the District provide a budget range or not-to-exceed amount for this engagement to help OƯerors calibrate an appropriately scoped and staƯed response?

No. We would anticipate that someone who has worked in this field with similar government utilities would be familiar with our environment and scope.

46. Beyond the 5 points allocated to “Fee proposal, transparency, and overall value” in Section 4.2, is pricing evaluated as a standalone factor, or does it also inform the scoring of other criteria such as Technical Approach?

Every eƯort has been made to establish a tool whereby we can evaluate submissions based on their services first without consideration of cost. Then we intend to evaluate the cost proposal separately. As a government special service district in Utah we have limitations on our budget and cannot spend limitless dollars on these services. We rely on all submissions to be considerate of this fact and recommend what they believe are necessary and prudent oƯerings.

47. Can the District specify the required minimum insurance limits referenced in Section 6.5 (commercial general liability, automobile liability, workers’ compensation, technology errors and omissions, and cyber/privacy liability)?

We have not specified certain items so that the QSP can submit their proposals based on their own information/expertise/experience in our industry. Each proposal will then be evaluated based on what is submitted.

48. Section 6.12 states that exceptions must be listed and that “silence will be treated as acceptance ... subject to final negotiation.” Can the District confirm that contract terms remain open to negotiation with the highest-ranked OƯeror prior to execution, consistent with the reservation of rights in Section 6.1?

We believe that 6.1 states what is allowed regarding negotiations and 6.12 is referring to exceptions they wish to impose for the evaluation process

49. Will subcontractor or teaming arrangements be permitted for portions of the scope (e.g., local onsite dispatch, specialized OT/SCADA security services), provided they are disclosed per Section 6.9?

All support must be local. We anticipate developing a close working relationship with our IT/Cyber provider personnel.

50. How many physical copies of the SOQ, and of the separately sealed fee proposal, are required for submission?

We did not specify a specific quantity and will allow you to submit an appropriate amount based on your experience with entities like ours. If your submission will require us to create additional copies for our evaluation team, we will do so with the resources we have available in-house.

51. Is there a maximum page limit for the main body of the SOQ (Sections 3.1.1 through 3.1.10), separate from the 5-page limit specified for Supplemental Information in Section 3.1.11?

We did not specify a maximum page limit. Please use discretion when considering what you submit.

52. Section 3.1.10 requires an “acknowledgement of GRAMA.” Is a specific form or required language provided by the District for this acknowledgment, or should OƯerors draft their own statement?

No specific form is required. We are referring to Utah GRAMA requirements.

53. If interviews or demonstrations referenced in Section 4.4 are required, will they be conducted in person or virtually?

We intend for these to be in person.

54. What is the anticipated timeframe between the Notice of Intended Selection (September 17, 2026) and final Board approval or contract execution?

We anticipate that the QSP will have a contract ready for submission immediately so that execution can happen quickly.

55. We have been asked the following:

# laptops?

# desktops?

#servers?

#firewalls?

#locations?

Do you use MS 365 for email?

How many mailboxes?

Do you want managed detection and response through Sophos?

We have answered these questions in the earlier responses.

56. Would you consider adding our product as your OT/SCADA security technology layer directly or alongside your selected MSP?

It is our desire to have one local IT/Cyber managed IT provider who handles all aspects of our IT. If they have gaps in their services we would rely on them to determine if your oƯer for services would be something we should pursue. We already have a Third party SCADA provider who works alongside our IT/Cyber provider.

57. What was the annual spend under the previous contract for these services?

This is not something we believe is necessary to provide for a quote for qualifications. We look forward to receiving each QSP best response/oƯer.

58. If this is a new contract, what is the estimated annual budget?

We have not set an estimated budget. We have asked for a thorough and complete response to our RFQ based on our needs as a government utility.

59. Is the agency open to a hybrid delivery model utilizing a combination of onshore and oƯshore resources?

Please see our responses to questions 19 and 25 above.

60. Will the work be performed onsite, remotely, or through a hybrid arrangement?

Variations of this question have been submitted and responded to in earlier questions. Please review those. We want a local provider of services as we intend to develop a close working relationship/partnership.

61. Would it be possible to consider a 1–2 week extension to the proposal submission deadline?

Unfortunately our timing does not permit an extension.

62. Is this contract intended for a single vendor or for multiple vendors?

This is intended for a single, local vendor.

63. Who is the current or previous incumbent vendor for these services?

We do not believe this is something that is relevant to preparing a response to our RFQ. We do have a very capable and successful relationship with our current vendor, and we do anticipate them submitting an RFQ. We are fulfilling our requirement as a government entity of the State of Utah to ensure we are receiving the best value and service and spend the funds we receive from the public wisely.

64. Are there any challenges, gaps, or pain points with the current solution or contractor that the agency is looking to address through this procurement?

We do not have anything specific that we need to highlight. We have always and still do emphasize cyber security as a top priority.

65. Is there a projected contract award date and anticipated start date?

We have included a schedule in the RFQ. We intend to maintain that schedule with one correction which is the target onboarding/service start date is January 1, 2027.

66. Are there any mandatory subcontracting goals associated with this contract?

Please clarify what you are asking for.

67. Is there a projected award and start date?

We have included a schedule in the RFQ. We intend to maintain that schedule with one correction which is the target onboarding/service start date is January 1, 2027.