5-QA 2.pdf

Q & A_2 26-005

ERATE SEIM_SOC_XDR Solution

How many desktops and laptops are allocated to faculty in Bibb County's IT environment?

35000

Does the County operate across multiple locations? If so, are these sites connected via VPN, SD- WAN, or independent networks? 40 locations, all connected via WAN fiber.

Is the County currently utilizing an EDR platform (e.g., CrowdStrike, SentinelOne, Microsoft Defender for Endpoint)? MS Defender for Endpoint

Is Entra ID (formerly Azure AD) or another cloud-based Identity Provider in use? If so, how many active user accounts are provisioned? Entra, 34,000

Are Linux servers included in your IT environment? Yes

Are there any other security-relevant data sources that should be considered for SIEM/XDR platform integration? Firewalls, switches, APs

Is email security required for both faculty and students? Yes

Is the integration of multiple layers of honeypot or deception technology within the customer’s network considered a mandatory requirement? Yes

Endpoint and Network Monitoring Scope: The SOC must monitor "all schools' endpoints" and "all north/south/east west traffic & DNS".

Beyond a general count, can you provide a breakdown of endpoint types (e.g., Windows workstations, macOS, Linux servers, mobile devices) and their approximate numbers? All estimates - 4k Windows, 300 macOS, 5 Linux server, 22k Chromebooks.

Are there estimated peak network traffic volumes (e.g., Mbps or Gbps) to help size the necessary monitoring capabilities? 14Gbps internet pipe, most internal traffic is internet bound

Honeypot/Deception Technology: The SOC must incorporate "multiple layers of honeypot/Deception technology".

Are there any specific preferences or requirements regarding the types or deployment strategies for the honeypot/deception technology (e.g., network-based, endpoint-based, specific vendors)?

Whatever the vendor deems appropriate.

External Pen Testing Scope: The SOC provider offers "external pen testing for up to 1000 IP addresses".

Is the "up to 1000 IP addresses" a maximum, or is there a minimum scope expected for the pen testing services? 1000 is maximum

Are internal penetration tests or vulnerability assessments also desired as part of this solution or as a separate optional service? No

CISO as a Service: The SOC provider offers "CISO as a service consulting services with on staff US based CISO 24x7".

Could you elaborate on the expected engagement model, frequency of interaction, and specific deliverables or responsibilities for the CISO as a Service? They just have to have one for future consideration, no expect use or cost in this project.

Server Protection: The XDR solution requires "Anti-ransomware and data exfiltration technology for physical and virtual servers".

Could you provide the approximate number of physical and virtual servers, including their operating systems and hypervisor platforms, that need this protection? 250 Virtual machines running on VMWare, 100 physical servers. Most all are current versions of Windows servers, only a few linux servers, Cloud Hosting Details: The SOC is to be hosted on "AWS or AWS equivalent with full redundancy with US based backup datacenter location and US based support".

Are there any specific compliance requirements (beyond SOC2, which is mentioned) or preferred AWS regions for hosting that we should be aware of? No

E-rate and Grant Requirements: Both projects are funded by grants and E-rate funds. The RFPs state that offerors must "be able to meet and have an approved process for acceptance" for E-rate and "validate all the grant/Erate requirements if awarded".

Could you please provide more specific details on the documentation or processes required to "validate" these grant and E-rate requirements for selected vendors? This is controlled by the FCC and USAC and can be found on their website.

Given that "Experience With Erate" is a significant evaluation criterion (150 out of 600 total points), what specific types of documentation or examples of past E-rate projects should we provide to demonstrate our experience effectively? Whatever the vendors feels compelled to provide.

Contract Term and Pricing for Renewals: The District intends to sign a contract for "one year with the option of four renewals".

How should we structure our pricing to account for the 3-year subscription service explicitly requested in the Scope of Work for both RFPs, aligning with the one-year term with four renewal options? Should the proposal include pricing for all potential renewal years? Total price for 3 years

Bid Submission Platform: The RFPs state that all submittals are completed via BONFIRE.

Could you confirm if there are any specific guidelines or instructions for file naming conventions or document uploads within the Bonfire portal beyond submitting a PDF document? None

Number of Locations/Users/Endpoints: To provide accurate cost estimates for services like email security and SIEM/SOC/XDR, it's critical to understand the scale of the environment.

Could you provide an approximate count of total staff/users, and the number of physical school locations that these solutions need to cover? 42 physical locations, 31k account

For RFP #26-005, a more precise number of endpoints (e.g., workstations, servers) to be monitored would be beneficial for pricing the SIEM/SOC/XDR solution. 35,000

Existing IT Environment Overview: While some systems like ServiceNow are mentioned, a broader understanding of the current IT landscape would be helpful.

Could you provide an overview of the existing IT infrastructure, including network topology, operating systems in use, and any other relevant security tools currently deployed? This would help in planning integrations and potential transitions. WAN with 10Gb fiber links across 42 locations. Cisco switches at the core and for routing at each site, meracki APs and edge switches. Windows Server, Linux Server, Windows 11, MacOS, iOS, ChromeOS. Currently use MS Defender for Endpoint and Cisco ISE for NAC.

Davis Bacon Requirements: The RFPs state that as "a grant funded project so please ensure you will be able to meet Davis Bacon Requirements as required". Could you clarify how Davis Bacon requirements apply to these specific IT service and software subscription RFPs? Any manhour labor would need to follow Bavis Bacon, service chargers do not.

Minority and Small Business Enterprises / Local Laborers: The District has a policy to increase participation by minority and small business enterprises and to utilize minority and local laborers.

Are there specific reporting requirements or forms that bidders need to complete to demonstrate compliance with this policy within the proposal submission? Any pertinent information should be submitted at the discretion of the vendor.