5-Response to RFQ questions 8.31.2026a.pdf

1. Section 3.2 lists "at least five years of organizational experience providing managed IT and cybersecurity services" as a minimum qualification. Could you clarify whether this may be satisfied through the collective professional experience of key personnel, and/or through a teaming or subcontracting arrangement with an established partner firm?

Response:

We prefer 5 years of experience providing these services as an organization. Please submit whatever experience you have in whatever arrangement or form and we will evaluate your submission based on what is submitted.

2. Section 3.2 also requires the ability to provide onsite support in Salt Lake County within the proposed service levels. Can onsite support be satisfied through a local subcontractor or partner rather than the prime OƯeror's own physical oƯice presence?

Onsite support cannot be satisfied through a local subcontractor or partner. It is our intent to create a close working relationship with a local provider.

3. The Section 5 schedule table lists the "Target onboarding / service start" date as January 1, 2026, which precedes the SOQ due date of September 15, 2026. Could you confirm whether this should read January 1, 2027?

The target service start date should be listed as January 1, 2027. The 2026 date was an error.

4. As far as discovery goes, will we be given access to do discovery on the network at KID before finalizing the RFQ, or is this simply indicating that those items will be required once we begin working together? I'm assuming the latter, but wanted to verify.

Access to do full network discovery will begin once we begin working together and have a contract in place.

5. Backups- Can we get additional information about the current system in place for backups, available hardware etc?

We have local backups on a redundant server, and a synology drive. A copy is pushed to a cloud platform daily.

6. Is there a copy of the current disaster recovery plan?

Yes. This will be made available to the selected provider of services, which they can use as a model or guide going forward.

7. Is there a current KID Incident response plan?

Yes. This will be made available to the selected provider of services, which they can use as a model or guide going forward.

8. Could the District clarify whether proposals and the separate fee schedule may be submitted electronically via email or a secure procurement portal instead of physical hard-copy mail?

In our RFQ we specified receipt of hard copy proposals by a specific date and time and ask that all submissions comply with that.

9. Can the District provide the current estimated inventory counts for managed physical servers, virtual servers, desktop/laptop workstations, mobile devices, and active network appliances (firewalls, switches, access points)?

Response:

Our business server infrastructure consists of two physical host servers configured as a redundant failover environment. The primary physical host runs nine virtual machines. A second physical host provides a duplicate/redundant environment capable of assuming those virtual server workloads in the event the primary host fails.

We have the same infrastructure for our SCADA. SCADA has a similar number of virtual machines running on them.

10. What is the total number of Microsoft 365 user licenses currently active, and what specific Microsoft licensing tiers (e.g., M365 Business Premium, E3, E5, GCC) are presently in place?

We have 32 MS 365 business premium user licenses.

11. What incumbent tools and platforms are currently deployed for RMM, EDR/MDR, centralized SIEM/log management, vulnerability scanning, and backup/disaster recovery?

Response:

We use widely used commercial software such as Sophos and Auvik, etc. We do not require or specify what must be used. We rely on the expertise of our IT/Cyber consultant to provide options and considerations in these areas.

12. Is the District seeking the Service Provider to provide and bundle all cybersecurity software licenses (EDR, MDR, SIEM, email security, vulnerability scanner) into the monthly service fee, or will KID procure licensing directly under its own agreements?

We prefer that the successful provider will bundle all licenses into their monthly services and fees. This includes annual support for servers, switches, renewal of domains, etc.

13. Regarding Section 2.7 (OT/SCADA Coordination), what specific SCADA software, hardware platforms, and communication protocols are currently utilized, and which third-party SCADA vendors maintain support agreements with KID?

We have a SCADA vendor who maintains all SCADA specific software and hardware with the exception of the actual SCADA host server. Our IT/Cyber consultant will maintain the host server environment and will work with them to provide network access and connectivity only. Our IT/Cyber consultant will work closely with them before making any changes to the SCADA host server hardware and software environment.

14. What is the current architecture and demarcation line between the District's enterprise IT network and the operational technology (OT/SCADA) network?

They are separate networks. They are physically separate and operate on separate network infrastructure, including separate host servers, switches, firewalls, etc.

15. Are there specific required onsite SLA response times for emergency (Critical / P1) and routine requests at the Kearns facility and remote well/pump station sites?

We don’t currently specify response times. All submissions will be evaluated and graded based on the submissions made by each vendor.

With regards to remote sites, currently the only involvement needed from our IT/Cyber vendor is help setting up and maintaining remote connectivity through cellular devices. This is very minimal and not mission critical. The main support provided by our IT/Cyber vendor will be at our oƯice and employees there.

16. How many distinct physical facilities or remote operational sites comprise the District's service territory that require network connectivity and potential onsite support?

We only have one oƯice where employees work. Our remote sites only require minimal help setting up and maintaining cellular connectivity on a very minimal basis.

17. What is the District's existing backup data volume in terabytes, and what are the current Target Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) for critical tier-1 applications?

We have 8-12 terabytes of data that is stored on redundant servers, backup drives and pushed to the cloud dailly. We do not specify any target times. All submissions will be judged and evaluated based on what target times you propose.

18. Is there currently an incumbent managed service provider delivering these services, or is this work currently managed internally or across multiple distinct vendor contracts?

Yes we do have an incumbent service provider providing all of this.

19. Regarding Section 3.3, if a Service Provider delivers 24/7 MDR/SOC and backup infrastructure directly through certified enterprise tools rather than third-party outsourced SOC vendors, what specific evidence or assurance documentation does the District prefer?

See response to question 25.

We have not specified specific SLAs. Your submission will be graded based on what you oƯer compared to others.

Non-US resources are not acceptable for SOC monitoring. All personnel responsible for SOC monitoring, security event analysis, incident response, or access to District systems and security data must be located within the United States. We will also give preference to local providers.

Having said that, we will evaluate your response based on responses from other providers. We rely on our IT/Cyber consultant to determine the best option and to provide assurance as to the veracity of their solution. We ask that it be explained clearly so that we may fairly evaluate it compared to others if they propose something diƯerent.

20. Will the District require personnel assigned to this contract to undergo specific background checks (e.g., Utah state background checks or CJIS-level screening) prior to accessing water/wastewater operational infrastructure?

Yes, but we put that responsibility on our provider to bear the burden and or cost of doing this before allowing personnel to work on our infrastructure.

21. For Section 2.4 (Penetration Testing and Cyber Audits), what is the expected scope (e.g., number of external IPs, internal subnets, web applications, or social engineering simulations) for the annual assessment?

We have completed cyber audits every 5 years, annual penetration testing, quarterly phishing, and monthly cyber training in the past. We welcome a robust proposal from our providers on what they recommend, as cyber protection is our top priority.

22. What specific compliance frameworks or reporting guidelines does the District currently utilize for EPA Risk and Resiliency Assessments and Emergency Response Plans?

We have applied the Security Controls listed in Appendix E of the Water Sector Cybersecurity Risk Management Guidance1(AWWA Guidance) document published by the American Water Works Association (AWWA) as the framework for this assessment. This framework includes 100 cyber-specific questions separated into 23 diƯerent cybersecurity categories. The USEPA (United States Environmental Protection Agency) recognizes four cybersecurity assessment frameworks as specifically applicable to the water sector and associates each with a diƯerent level of program maturity. The AWWA Security Controls used for this assessment represent the third level of maturity and are appropriate for organizations where cybersecurity is part of the culture and cybersecurity practices are sustainable over the long term.

The Cyber Security Evaluation Tool (CSET) designed by the federal Cybersecurity and Infrastructure Security Agency (CISA) was used to conduct this assessment.

The CSET tool includes modules for many diƯerent cybersecurity frameworks, including the AWWA Security Controls.

The responses recorded during the assessment are used as the basis for rating the protection elements defined in the ANSI/AWWA J100-21 Risk and Resilience Management of Water and Wastewater Systems2 (J100). This process ties the cyber risk assessment into the larger RRA eƯort. The assessment results also establish a cybersecurity baseline that can be used to track progress and improvements moving forward

23. What is the anticipated budget for this contract?

Budget is only a portion of this contract. We will first evaluate each submission without referring to the cost. Then we will look at costs and evaluate each by cost.

It is our experience that prices vary widely based on oƯerings. Because we are a government entity, we are very cost conscious. Please provide your best price with as much explanation and detail as possible so that we can fairly evaluate each based on price and what is being oƯered in return. Also provide detail on what items are optional and may be declined to reduce costs.

We anticipate that a large amount of the services provided will be cyber services and keeping all of our infrastructure up to date. With 32 users, and only 1 business and 1 SCADA server (each with redundancy) our day to day service needs are minimal because we like to keep our hardware infrastructure up to date.

We have found that properly maintained and updated servers, firewalls, switches, workstations, and other infrastructure is less expensive than down time and emergencies.

24. Is local Utah staƯ mandatory or can onsite support be provided through regional resources?

Onsite support cannot be satisfied through a local subcontractor or partner. It is our intent to create a close working relationship with a local provider.

See question 2 and our response to that above.

25. What are the expected onsite response SLAs? 3. Are non-US resources acceptable for SOC monitoring?

We have not specified specific SLAs. Your submission will be graded based on what you oƯer compared to others.

Non-US resources are not acceptable for SOC monitoring. All personnel responsible for SOC monitoring, security event analysis, incident response, or access to District systems and security data must be located within the United States. We will also give preference to local providers.

26. Are references from regulated industries acceptable if utility references are limited?

References from organizations similar in size, scope, and operating environment to the District are preferred, particularly other local government, water, wastewater, or utility organizations. However, references from other regulated industries may also be provided for consideration if they demonstrate comparable services, technical complexity, security requirements, and regulatory obligations.

27. Does KID expect penetration testing to be performed by the prime contractor or an approved subcontractor?

Response:

The District prefers penetration testing to be performed directly by the prime contractor. Use of a subcontractor would require prior written approval from the District, and the subcontractor would be subject to the same security, confidentiality, access-control, and data-handling requirements as the prime contractor.

28. Are you going to have the managed service provider choose the product or will that be done by yourself?

Response:

We have not specified any particular product or tool and will evaluate your submission compared to what others submit and our experience has been in the past with industry tools.

29. Under the 'Prepare Your Submission' section at the bottom left on the main page it says: "This Opportunity does not require Submissions". Is that because you require proposals to be physically mailed?

Response: In our RFQ we specified receipt of hard copy proposals by a specific date and time and ask that all submissions comply with that.

30. What line-of-business applications (e.g., billing/CIS, GIS, financial/ERP, engineering, records management) are currently in use, and are any of these hosted or managed by third-party vendors outside the scope of this RFQ?

As a local government utility provider we do utilize software tools that are typical for our industry. For example, we do bill our customers monthly, and we do map our infrastructure. We do design and install water and sewer infrastructure. We have administrative software, engineering software, operations software. Most are cloud based, but some are located on our physical servers. Our IT/Cyber provider will be expected to work with our third party software providers to ensure these tools function on our networks.

31. Is there a minimum expected onsite cadence (e.g., scheduled recurring visits), or is onsite support expected to be dispatch-based/as-needed only?

There is no minimum expected onsite cadence. It is up to our provider to propose what they believe works best for this including maintenance, planning, road mapping, etc.

32. Is there a current incumbent Managed IT/Cybersecurity provider, and if so, may the incumbent submit a response to this RFQ?

Yes, there is an incumbent provider and we fully expect them to submit a response to this RFQ. As a government entity in Utah, it is expected and often required that we go out to bid regularly for services. You may anticipate regular bidding regarding our IT/Cyber services in the future.

33. If an incumbent exists, are there known contractual constraints (e.g., notice periods) that would aƯect the transition timeline referenced in Section 2.1?

Yes, and all notices have been provided as specified in contract. If a transition to a new provider results from this RFQ, the incumbent is fully aware as they are familiar with government entities and purchasing requirements in Utah that we must comply with.

34. What is the current state of technical documentation (network diagrams, asset inventories, policies)? Should OƯerors assume existing documentation as a starting point, or plan for discovery from a limited-documentation baseline?

All technical documentation is up to date.

35. What SCADA/ICS platform(s) and PLC hardware are currently in use (vendor and model), and approximately how many PLCs and remote/field sites are connected to the SCADA environment?

The winning submission will be provided this information. Our third party SCADA provider will maintain all communications and PLCs/remote sites that are part of the environment. Our IT/Cyber provider will only be expected to support our third party SCADA provider through the design and maintenance of the network/server environment on which the SCADA network runs.

36. Is the OT/SCADA environment currently segmented from the District’s business IT network, and if so, can the District describe the current segmentation approach (e.g., firewalled DMZ, air-gapped, unidirectional gateway)?

Our SCADA is a separate network entirely. Separate servers, firewalls, DMZ, etc.

37. Who currently manages the SCADA environment day-to-day — District staƯ, a specialized SCADA integrator or vendor, or is this fully within the scope of this RFQ?

Our third party SCADA vendor manages our SCADA software and provide us technical support for operating the software. Our staƯ operate the software only.

Our IT/Cyber provider will design and maintain the separate network infrastructure only. They will work closely with our SCADA providers to maintain the SCADA network environment so that the SCADA software operates.

38. If a separate SCADA vendor manages the OT environment, will that vendor continue in that role, and what division of responsibility does the District anticipate between the QSP and the SCADA vendor under Section 2.7?

Our SCADA vendor will continue in their current role to maintain the software.

Our IT/Cyber provider will maintain the SCADA network infrastructure.

39. Has the District previously completed the EPA Risk and Resiliency Assessment referenced in Section 2.9? If so, can relevant findings or the resulting cybersecurity framework baseline be made available to OƯerors under a controlled due-diligence process, or to the awarded QSP post-award?

We have completed two EPA assessments. Relevant findings will be available post award only.

40. Does the District currently have cybersecurity tools in place (EDR, SIEM, email security, MFA, backup platform, etc.) that the awarded QSP would be expected to inherit and manage, or is the QSP expected to propose and implement a full tooling stack?

We do have a full spectrum of tools in place. The winning QSP will determine whether or not to continue with current tools or propose new solutions based on their expertise.

41. Section 2.4 lists penetration testing as part of the scope, but does not specify a breakdown. Can the District clarify its penetration testing requirements — including expected frequency or cadence (e.g., annual, per contract year), number of tests, scope by device/system/IP count, internal versus external testing, whether OT/SCADA systems are in scope, and whether testing must satisfy a specific compliance framework or cyber-insurance requirement?

Response:

We have not specified this level of service details, as we are relying on QSPs to demonstrate their expertise and experience in these areas by submitting a robust and thorough proposal.

42. Section 3.1.10 requires disclosure of “material cyber incidents relevant to service delivery.” Please confirm whether this requires the OƯeror to disclose its own incident history, the District’s incident history, or both.

This was referring to the QSP who was submitting a proposal for our consideration.

43. Does the District currently hold a cyber/privacy liability insurance policy, and if so, is there a specific carrier or policy structure the QSP would be expected to support through the insurance-questionnaire assistance referenced in Section 2.8?

Yes, and the insurance questionnaire is quite substantial and will require the QSP to respond in significant detail to the application.

44. Is the “optional cyber security audit/review” referenced in Section 2.4 intended to be priced as a separate, distinct line item from the core managed cybersecurity operations scope?

Yes. We would expect the QSP to recommend/oƯer these additional services as part of their relationship to the District.

45. Can the District provide a budget range or not-to-exceed amount for this engagement to help OƯerors calibrate an appropriately scoped and staƯed response?

No. We would anticipate that someone who has worked in this field with similar government utilities would be familiar with our environment and scope.

46. Beyond the 5 points allocated to “Fee proposal, transparency, and overall value” in Section 4.2, is pricing evaluated as a standalone factor, or does it also inform the scoring of other criteria such as Technical Approach?

Every eƯort has been made to establish a tool whereby we can evaluate submissions based on their services first without consideration of cost. Then we intend to evaluate the cost proposal separately. As a government special service district in Utah we have limitations on our budget and cannot spend limitless dollars on these services. We rely on all submissions to be considerate of this fact and recommend what they believe are necessary and prudent oƯerings.

47. Can the District specify the required minimum insurance limits referenced in Section 6.5 (commercial general liability, automobile liability, workers’ compensation, technology errors and omissions, and cyber/privacy liability)?

We have not specified certain items so that the QSP can submit their proposals based on their own information/expertise/experience in our industry. Each proposal will then be evaluated based on what is submitted.

48. Section 6.12 states that exceptions must be listed and that “silence will be treated as acceptance ... subject to final negotiation.” Can the District confirm that contract terms remain open to negotiation with the highest-ranked OƯeror prior to execution, consistent with the reservation of rights in Section 6.1?

We believe that 6.1 states what is allowed regarding negotiations and 6.12 is referring to exceptions they wish to impose for the evaluation process

49. Will subcontractor or teaming arrangements be permitted for portions of the scope (e.g., local onsite dispatch, specialized OT/SCADA security services), provided they are disclosed per Section 6.9?

All support must be local. We anticipate developing a close working relationship with our IT/Cyber provider personnel.

50. How many physical copies of the SOQ, and of the separately sealed fee proposal, are required for submission?

We did not specify a specific quantity and will allow you to submit an appropriate amount based on your experience with entities like ours. If your submission will require us to create additional copies for our evaluation team, we will do so with the resources we have available in-house.

51. Is there a maximum page limit for the main body of the SOQ (Sections 3.1.1 through 3.1.10), separate from the 5-page limit specified for Supplemental Information in Section 3.1.11?

We did not specify a maximum page limit. Please use discretion when considering what you submit.

52. Section 3.1.10 requires an “acknowledgement of GRAMA.” Is a specific form or required language provided by the District for this acknowledgment, or should OƯerors draft their own statement?

No specific form is required. We are referring to Utah GRAMA requirements.

53. If interviews or demonstrations referenced in Section 4.4 are required, will they be conducted in person or virtually?

We intend for these to be in person.

54. What is the anticipated timeframe between the Notice of Intended Selection (September 17, 2026) and final Board approval or contract execution?

We anticipate that the QSP will have a contract ready for submission immediately so that execution can happen quickly.

55. We have been asked the following:

# laptops?

# desktops?

#servers?

#firewalls?

#locations?

Do you use MS 365 for email?

How many mailboxes?

Do you want managed detection and response through Sophos?

We have answered these questions in the earlier responses.

56. Would you consider adding our product as your OT/SCADA security technology layer directly or alongside your selected MSP?

It is our desire to have one local IT/Cyber managed IT provider who handles all aspects of our IT. If they have gaps in their services we would rely on them to determine if your oƯer for services would be something we should pursue. We already have a Third party SCADA provider who works alongside our IT/Cyber provider.

57. What was the annual spend under the previous contract for these services?

This is not something we believe is necessary to provide for a quote for qualifications. We look forward to receiving each QSP best response/oƯer.

58. If this is a new contract, what is the estimated annual budget?

We have not set an estimated budget. We have asked for a thorough and complete response to our RFQ based on our needs as a government utility.

59. Is the agency open to a hybrid delivery model utilizing a combination of onshore and oƯshore resources?

Please see our responses to questions 19 and 25 above.

60. Will the work be performed onsite, remotely, or through a hybrid arrangement?

Variations of this question have been submitted and responded to in earlier questions. Please review those. We want a local provider of services as we intend to develop a close working relationship/partnership.

61. Would it be possible to consider a 1–2 week extension to the proposal submission deadline?

Unfortunately our timing does not permit an extension.

62. Is this contract intended for a single vendor or for multiple vendors?

This is intended for a single, local vendor.

63. Who is the current or previous incumbent vendor for these services?

We do not believe this is something that is relevant to preparing a response to our RFQ. We do have a very capable and successful relationship with our current vendor, and we do anticipate them submitting an RFQ. We are fulfilling our requirement as a government entity of the State of Utah to ensure we are receiving the best value and service and spend the funds we receive from the public wisely.

64. Are there any challenges, gaps, or pain points with the current solution or contractor that the agency is looking to address through this procurement?

We do not have anything specific that we need to highlight. We have always and still do emphasize cyber security as a top priority.

65. Is there a projected contract award date and anticipated start date?

We have included a schedule in the RFQ. We intend to maintain that schedule with one correction which is the target onboarding/service start date is January 1, 2027.

66. Are there any mandatory subcontracting goals associated with this contract?

Please clarify what you are asking for.

67. Is there a projected award and start date?

We have included a schedule in the RFQ. We intend to maintain that schedule with one correction which is the target onboarding/service start date is January 1, 2027.

68. Section 5 lists a target onboarding/service start of January 1, 2026, which precedes the RFQ issuance date. Please confirm the intended contract award and service-start dates.

The intended start date was mis printed. The correct date is January 1, 2027 and has been updated.

69. The RFQ lists August 31, 2026, as the deadline for questions, while the procurement portal states the Q&A period is ongoing. Please confirm the final deadline for written questions.

We are following the schedule listed in schedule 5 of the RFQ.

70. Please provide estimated quantities for managed users, workstations, physical servers, virtual servers, network devices, remote sites, Microsoft 365 tenants/licenses, and critical applications.

This question has been asked and responded to earlier in this document.

71. How many KID locations, remote facilities, pump stations, or field sites require support? What onsite response times are expected for critical, high, and routine issues.

This question has been asked and responded to earlier in this document.

72. Are there incumbent IT, MSP, SOC/MDR, backup, telecom, Microsoft 365, network, SCADA, or cybersecurity providers? If so, what transition cooperation, documentation, administrative access, and contract end dates should the selected provider anticipate?

Response: This question has been asked and responded to earlier in this document.

73. What are KID's normal business hours, approximate monthly ticket volume, user-support expectations, and preferred method for after-hours support and critical escalation?

Our oƯices are open M-Th 7:00 am to 5:30 pm MST. We have addressed the other items in your inquiry in the responses above.

74. Does KID expect the selected provider to have authority to isolate endpoints, disable accounts, block malicious communications, or make other containment actions before obtaining approval? If so, what actions may be pre-authorized?

We have not specified services to the detail level you are asking. We would ask that you provide your recommended level of service necessary to service our account based on your experience with government utilities of similar size to us.

75. Which current log sources are available or required for centralized monitoring, and does KID have specific log-retention, data-residency, or evidence-preservation requirements?

Similar to responses earlier, we have not specified services to the detail level you are asking. We would ask that you provide your recommended level of service necessary to service our account based on your experience with government utilities of similar size to us.

76. Please identify the scope of the selected provider's authorized involvement with OT/SCADA systems. Which SCADA, engineering, controls, and integrator vendors will retain system-administration responsibility?

We have been asked similar variations of this question earlier. We would ask that you please review our responses to those questions earlier in this document.

77. Does KID have existing IT/OT change-control procedures, maintenance windows, remote-access standards, and approved procedures for firewall, segmentation, or remote-vendor-access changes?

Yes. All of this was developed in partnership with our current provider. We would anticipate doing something similar with a new provider should a change occur based on this RFQ.

78. Please clarify the expected frequency, scope, and authorization requirements for authenticated vulnerability scanning, unauthenticated scanning, and penetration testing, including any excluded OT/SCADA assets or restricted maintenance windows.

We have not specified service levels to this detail so that submissions can be made based on what you recommend as necessary based on your experience with government utilities in the past.

79. What systems are currently backed up, what backup technologies are in use, and are there defined recovery-point objectives (RPOs), recovery-time objectives (RTOs), immutable-backup requirements, or recovery-testing expectations?

This question has been asked in diƯerent variations in prior questions. We are looking for any QSP to provide their recommendations based on their experience with entities such as ours.

80. What Microsoft 365 licensing tier, identity architecture, MFA deployment status, privileged-account model, and email-security tools are currently in place?

This question has been asked and responded to in earlier questions.

81. Does KID prefer the successful provider to manage existing security tools where practical, or should oƯerors price a replacement/standardized tool stack for MDR/EDR, email security, vulnerability management, backup, security awareness, and SIEM/logging?

This question has been asked in diƯerent variations in prior questions. We are looking for any QSP to provide their recommendations based on their experience with entities such as ours.

82. The RFQ identifies an "optional cybersecurity audit/review with assessment reporting." Should oƯerors include an initial cybersecurity assessment and remediation roadmap in the base scope, or price it separately as an option?

We have specified this as an optional service in the RFQ. However, we would leave it to your discretion if you would prefer to include or not in your submission.

83. What specific support does KID expect for its EPA Risk and Resiliency Assessment, emergency-response planning, state obligations, and cyber-insurance requirements?

Because we are seeking a service provider to deliver managed IT/Cyber services we would anticipate they would take full responsibility for these items.

84. Must onsite support personnel be directly employed by the prime contractor, or may a disclosed and KID-approved Salt Lake County field-services subcontractor fulfill onsite response requirements?

This question has been asked and responded to in previous questions. We are seeking a local provider of services with which we can develop a close working relationship. Support cannot be provided through a subcontractor.

85. Are prime-contractor/subcontractor teams acceptable where the prime contractor holds overall accountability and all material providers, support locations, data-processing regions, and shared responsibilities are fully disclosed?

This question has been asked and responded to in previous questions. We are seeking a local provider. Support cannot be provided through subcontractors.

86. Can KID provide the anticipated minimum limits for general liability, automobile, workers' compensation, technology errors and omissions, and cyber/privacy liability?

This question has been asked and responded to in earlier questions. We look for a provider to submit their recommendations based on their experience with government entities such as ours.

87. Is KID able to provide an anticipated annual budget range, preferred pricing structure, or estimated quantities so oƯerors can prepare comparable pricing for onboarding, recurring managed services, licensing, projects, and after-hours work?

This question has been asked and responded to in earlier questions. We look for a provider to submit their recommendations based on their experience with government entities such as ours.

88. Will KID provide a draft services agreement before selection or during negotiations, particularly for indemnification, limitation of liability, data ownership, public-records obligations, audit rights, and transition-assistance requirements?

We look to any QSP to provide their proposed agreement, subject to negotiation and changes based on our review, for consideration.

89. Beyond the published scoring criteria, are there specific priorities that will distinguish highly ranked proposals—for example local onsite support, water/utility experience, SOC ownership, existing tool compatibility, or OT/SCADA experience?

We have made every eƯort to specify our priorities in the RFQ. We believe that the criteria we have specified makes these known.