6-QA 3.pdf

Q & A_3 26-005

ERATE SEIM_SOC_XDR Solution

Could you provide a breakdown of the estimated number of users and endpoints across the Bibb County School District network? Roughly 31k active accounts and roughly 35k devices

What are the currently deployed SIEM, XDR, endpoint protection, or other security solutions in use across the district? MS Defender and MS Sentinel

Please share the full list of assets (servers, endpoints, network devices) that are expected to be covered under the proposed solution. All estimates - 6k Windows, 300 macOS, 5 Linux server, 22k Chromebooks, 6500ios, Meraki APs: 2400, Meraki Switches: 950, Cisco Switches: 70, Palo Alto Firewalls: 2 - PA5220

Is the district seeking a fully managed solution including technology deployment and ongoing service, or does the scope include licensing only? Licensing and deployment

The RFP mentions hosted SIEM/SOC/XDR—are specific OEM technologies preferred or already in place? MS Sentinel

Can you confirm whether integration with any existing systems (e.g. ticketing tools, network monitoring platforms) is required? MS Sentinel

Is the expectation for the SOC vendor to provide only monitoring, or are active incident response and containment required as part of the scope? Monitoring and notifications

The RFP states 24x7 access to analysts—is full 24x7 monitoring and incident handling mandatory, or would alternate schedules (e.g. 8x5 with on-call) be considered? 24x7

What level of post-installation support is expected beyond initial onboarding—will ongoing monitoring, reporting, pen testing, and consulting be part of the contract? Monitoring and notifications

Is the Bibb County School District currently using Microsoft licensing tiers such as G3, G5, or G5 Security? A5

Could the district please clarify the use of Chromebooks within the school environment, including whether any endpoint detection and response (EDR) or security controls are currently in place to monitor or manage these devices? No endpoint detection is currently in place

If a vendor proposes Microsoft-based solutions (e.g. Defender XDR, Sentinel), would the district expect the vendor to provide the necessary G3/G5 or A3/A5 licenses? If additional licensing is needed, then yes

Are there any anticipated upgrades or changes to Microsoft licensing tiers over the course of this contract term? No

Can you confirm whether this SEIM/SOC/XDR solution is fully covered under E-rate funding, and if so, what is the total funding cap allocated for this project? It is up to the vendor to make sure it is fully covered by erate, we do not provide a funding cap

Could you please clarify what information to e provided in 5. Proposal information. Do not understand the question

Is there currently an incumbent company or previous incumbent, who completed a similar contract performing these services? No

If so - are they eligible to bid on this project and can you please provide the incumbent contract number, dollar value, and period of performance? N/A

Can you tell the total number of endpoints you want to be protected? Roughly 35k

What’s your headcount of users (employees + contractors+ interns)? What number/percentage of your workforce resides within organizational facilities? What number/percentage works remotely? 4000, all within our facilities

How much (%) of the infrastructure is in the cloud? 50

What is the size of the IT environment? To generic of a question

How many physical locations? 42

What is the aggregate Internet Capacity per location (<300mbps, <1gbps, <4gbps, up to 10gbps)? 14Gbps primary pipe

Do you manage your own data Center, or do you utilize any 3rd-party/colocation facilities?

Yes, we also have a single colo for backup

What is the approximate budget? There is not a set budget

Are any vendor products installed for Security Incident & Event Management (SIEM)? If yes, please provide the currently used SIEM product name. MS Sentinel

Is there EDR, Anti-virus, and Anti-malware in place today? Yes

Is there a current log collection (SEIM) service? If so, is it internally or externally managed?

Yes, internally

What security tools are already in place? I.E., firewalls, endpoint protection, vulnerability management, email, identity access management, networking (routers, switches, access points), user behavior analytics, network threat analytics, security orchestration automation, response (SOAR), etc. Sentinel, Defender, M365, Meraki APs: 2400, Meraki Switches: 950, Cisco Switches: 70, Palo Alto Firewalls: 2 - PA5220

How is the network architected? I.E. How many sites will be in scope, all coming back or decentralized (stand-alone sites, mesh network, hub and spoke, SD WAN)? 42 across a hybrid mesh and hub/spoke

What percentage of your servers are virtual versus physical? 250/100

How many Internet connections exist, and what is the speed of each connection? (This is to help us understand the monitoring of all incoming and outgoing Internet activity. For example, an organization may have 2 main offices, each office connecting with 1Gbps links.) 14gbps primary, 10gb secondary at colo that is only used if 14gbps connection is down

24/7 CISO Access Expectations

What is the specific scope of services and availability expected for the “24/7 CISO access” requirement? Consulting in the events of needing information or brainstorming direction

Will the district define expected response times for CISO engagement (e.g., immediate, 1 hour, 4 hours) or should the vendor propose them? Vendor discretion

Can the vendor delegate more than one CISO or rotate individuals, provided there is seamless collaboration and communication with the district? Yes

SOC / Incident Response Performance Metrics

What is the maximum acceptable time for initial detection of critical threats?

Whatever is industry standard

What is the target or maximum time for initial SOC analyst response once a critical alert is identified? Whatever is industry standard

What are the expectations for incident containment (time to stop active threat) and resolution (time to fully remediate)? Whatever is industry standard

Hosted Solution Uptime & Availability

What uptime SLA is required for the hosted SIEM/SOC/XDR platform (e.g., 99.9%, 99.99%)? 99.9

Security Reporting Requirements

Desired report frequency (e.g., daily summaries, weekly briefs, monthly executive reports, quarterly board presentations). Vendor discretion

Primary audience for these reports (e.g., IT Director, School Board, CISO, Superintendent). All of the above

Data Retention & Storage Requirements

Specific data retention periods for security logs ingested into the SIEM:

Hot storage (immediate access) duration. Whatever is industry standard

Warm storage (slower retrieval) duration. Whatever is industry standard

Cold/archived storage duration. Whatever is industry standard

Any compliance-driven retention mandates (e.g., 1 year, 3 years, 7 years).

Whatever is industry standard

Compliance & Regulatory Requirements

Beyond SOC 2, E-rate, and general grant requirements, are there other compliance frameworks or policies that must be adhered to, such as: FERPA, CIPA , NIST Cybersecurity framework

FERPA (Family Educational Rights and Privacy Act)

CIPA (Children’s Internet Protection Act)

State-specific student data privacy laws

Other district-specific cybersecurity or data governance policies