7-Addendum 1 - RFP 031-25 Cybersecurity Pilot Program.pdf

ADDENDUM # 1

RFP 031-25 Cybersecurity Pilot Program 2025

Released: June 27, 2025

Where any original item, term, or requirement is not specifically amended, voided or superseded by this addendum, it will remain in effect. This clarification is being provided to all known respondents.

1. Clayton County Public Schools (CCPS) has received questions pertaining to this RFP.

The questions and their resulting answers are attached hereto.

2. The Pre-Proposal Conference Agenda and Sign-in Sheet pertaining to this RFP are attached hereto as Exhibit 1.

Debra B. Brewer, Esq., CPPO Issue Date Director of Procurement

ACKNOWLEDGEMENT

This sheet must be completed, signed, and returned with any proposal to acknowledge receipt of this Addendum. Failure to do so may result in the rejection of any proposal submitted.

The above addendum is hereby acknowledged:

Signature

Title

Company Name

Date

7/14/2025 | 2:42:32 PM EDT

QUESTION 1: Can you confirm the current Microsoft licensing tier in use (e.g., M365 G3, G5, or G5 Security add-on), particularly in context of Entra ID, Defender XDR, or security feature eligibility?

ANSWER Office 365 A1 Plus

QUESTION 2: Do you have any preferred cybersecurity vendors or platforms that you would like bidders to align with?

ANSWER The district is looking for a single pane of glass solution that fits within the requirements outlined in the RFP.

QUESTION 3: Are you looking to retain any of the existing cybersecurity tools, or are you open to a full replacement if a better integrated solution is proposed?

ANSWER We currently use Cisco Secure Endpoint (Cisco AMP) and Cisco

Umbrella which we prefer to retain due to familiarity and cost. The district is open to other options if the total costs of replacement are provided and deemed the most cost-effective.

QUESTION 4: Are there any tools or platforms that must remain in place due to licensing, integration, or operational dependencies?

Umbrella which we prefer to retain due to familiarity and cost. The district is open to other options if the total costs of replacement are provided and deemed the most cost-effective.

QUESTION 5: Can you clarify which cloud platforms or data channels (e.g., Google

Drive, OneDrive, email, USB, print) you would like Data Loss Prevention policies enforced on, and whether you require predefined templates or custom rule creation?

ANSWER DLP is required for our Google Workspace environment as well as out local network (i.e. servers, USB, print)

QUESTION 6: Are any of the referenced tools in the RFP (e.g., Trend Micro Vision One, Tipping Point, Deep Discovery) currently in use, or are they listed only as examples?

ANSWER The tools referenced are not currently in use and used as examples of the types of services and tools we are looking for.

QUESTION 7: Can you confirm which cybersecurity tools or platforms are currently deployed across the district (e.g., endpoint protection, email security, firewalls, SIEM, MDR)?

ANSWER We currently use Cisco Secure Endpoint (Cisco AMP), Cisco

Umbrella and Palo Alto firewalls

QUESTION 8: How will cost vs. technical capability be weighted in the final evaluation?

ANSWER Please refer to the “General Information” section, Evaluation Process in the RFP for information regarding the relative weight and maximum points pertaining to all items to be evaluated.

QUESTION 9: Beyond MDR, does CCPS require continuous security monitoring and full incident management services, including investigation, escalation handling, and post-incident reporting?

ANSWER Yes

QUESTION 10: Are there any KPIs or SLAs that vendors should commit to for threat detection and response?

ANSWER Vendors should provide their commitments to Mean Time to

Respond (MTTR), Mean Time to Contain (MTTC), Mean Time to Detect (MTTD), Platform Uptime

QUESTION 11: What are your expectations around reporting and dashboards

(e.g., frequency, format, audience)?

ANSWER We are expecting a customizable dashboard that can generate custom reports and acts as a single pane of glass for the tools and services being proposed.

QUESTION 12: Are there any specific compliance frameworks (e.g., FERPA, CIPA, NIST, CJIS) that the solution must adhere to?

ANSWER The district would prefer alignment with NIST

QUESTION 13: Should the proposed solution include both on-prem and cloud-based threat detection?

QUESTION 14: Are you expecting vendors to provide a fully managed MDR service or a co-managed model?

ANSWER Fully managed

QUESTION 15: Please share Number of users students, staff, faculty etc.?

ANSWER There are around 60,000 users in total

QUESTION 16: Are all users (students, staff, faculty) expected to be covered under the proposed solution?

QUESTION 17: Can you provide a breakdown of the approximate number of:

a. Endpoints (Windows, macOS, ChromeOS, iOS, Android)?

b. Servers (on-prem vs. cloud)?

c. Network devices (firewalls, switches, routers)?

ANSWER a. 111,424

b. 345

c. 1,714

QUESTION 18: Is there a centralized identity provider (e.g., Azure AD, Google Identity, Okta) currently in use?

ANSWER The District has multiple identity providers: on-prem AD, Google Workspace, ClassLink and Entra for Office 365

QUESTION 19: Are there any preferred APIs or platforms that the proposed solution must integrate with?

ANSWER Google Workspace (specifically Google Drive)

QUESTION 20: Are there any mandatory integrations required with existing systems

(e.g., SIS, LMS, Google Workspace, M365)?

ANSWER Google Workspace (specifically Google Drive)

QUESTION 21: Is there an existing SOC (Security Operations Center) or is this function outsourced?

ANSWER There is no existing SOC internally or through a third party.

QUESTION 22: What is the current endpoint protection solution in place across the district?

ANSWER We currently use Cisco Secure Endpoint (Cisco AMP)

QUESTION 23: Are there any existing SIEM, EDR, or MDR solutions deployed? If yes, are you looking to replace or integrate with them?

Umbrella which we prefer to retain due to familiarity and cost

QUESTION 24: Can you confirm which cybersecurity tools or platforms are currently in use (e.g. Trend Micro, Microsoft Defender, CrowdStrike, etc.)?

ANSWER We currently use Cisco Secure Endpoint (Cisco AMP), Cisco Umbrella and Palo Alto firewalls

QUESTION 25: Do we need to register for the prebid call?

ANSWER No.

QUESTION 26: Do you want the pricing to be for the first year only or the total for 3 years?

ANSWER Pricing should be provided for the full 3 years, however, pricing should be itemized for each year.

QUESTION 27: Are you looking for one vendor to fulfill all needs?

ANSWER As per the “General Information” section, Intent to Award in the

RFP “CCPS intends to make one (1) award; however, CCPS reserves the right to make one (1) award, multiple awards or no award for RFP No: 031-25 Cybersecurity Pilot Program 2025. All contract awards are contingent upon Cybersecurity Pilot Program approval.

QUESTION 28: What are the major pain points with current solutions?

ANSWER Please refer to the Objective section on page 9 of the RFP.

QUESTION 29: How many NGFWs are in scope? Do they need to be managed?

ANSWER Firewalls were not requested. Please refer to page 56 of the RFP.

QUESTION 30: What is the current incident response process?

ANSWER We are in the process of rewriting our IRP and DRP processes

QUESTION 31: Are you looking for an MDR solution? If so, what specific MDR features are considered mandatory vs. optional?

ANSWER Yes.

Please refer to Attachment A-Scope of Services and

Specifications, section D. Monitoring, Detection and Response in the RFP for information regarding MDR features

QUESTION 32: How many students?

ANSWER Approximately 52000

QUESTION 33: How many staff?

ANSWER Approximately 6200

QUESTION 34: How many endpoints broken down by laptops/PC’s and servers?

ANSWER 354 VM servers, 8177 Windows laptops and 8477 Windows desktops

QUESTION 35: What EDR vendor is in use today?

ANSWER Cisco Secure Endpoint

QUESTION 36: How are you currently monitoring and securing your endpoints?

QUESTION 37: Does the organization have Microsoft licensing? If so, what level?

ANSWER Office 365 A1 Plus

QUESTION 38: Is integration with existing SIEM or SOAR platforms required or planned?

ANSWER There are no current SIEM/SOAR platforms

QUESTION 39: If there is an existing SIEM, what data sources are feeding into it?

ANSWER There are no current SIEM/SOAR platforms

QUESTION 40: Does your team require access to the logs in the SIEM?

QUESTION 41: What is the expected volume of alerts or incidents per month?

ANSWER That has not been determined as of yet.

QUESTION 42: Are there any specific compliance frameworks (e.g., NIST, CIS, ISO

27001) the MDR solution must align with?

ANSWER The district would prefer NIST

QUESTION 43: Will the MDR provider be expected to take direct remediation actions, or only provide recommendations?

ANSWER The MDR provider would be expected to take direct remediation actions

QUESTION 44: Is there a preferred method for communication and escalation (e.g., ticketing system, phone, email)?

ANSWER Email and phone

QUESTION 45: What reporting cadence is expected (e.g., monthly, quarterly), if at all?

ANSWER Monthly

QUESTION 46: Are there any data residency or sovereignty requirements?

ANSWER Yes. Data must reside in the United States

QUESTION 47: Is there a desired go-live date for services?

ANSWER A go-live date will be determined after FCDL issuance

QUESTION 48: Will there be a transition period from an existing MDR provider or is this a new implementation?

ANSWER No, there is no current MDR solution.

QUESTION 49: Will you require assistance with onboarding, tuning, or policy configuration?

QUESTION 50: What operational risk exists?

ANSWER Please refer to the Objective section on page 9 of the RFP.

QUESTION 51: How are you protecting again email phishing attacks?

ANSWER The district currently uses policies and filters in Google

Workspace to protect against phishing.

QUESTION 52: What’s your vulnerability and patch management strategy?

ANSWER AD Manager Patch Management

QUESTION 53: In general, what vendors/solutions are in use in your technology stack today: SIEM, EDR, SOAR, Vulnerability Management, Email Protection Security, MFA, security awareness training, firewalls, networking

ANSWER Cisco DUO, Cisco Secure End Point, KnowBe4, Palo Alto firewalls, Cisco/Meraki switches & access points, Cisco Umbrella, Workspace One

QUESTION 54: From a pricing perspective, what services are you looking to see priced out?

ANSWER Please refer to the RFP

QUESTION 55: From a pricing perspective, what are the quantities that you would like to see?

a. Number of firewalls

b. Number of staff

c. Number of students

d. Number of endpoints

ANSWER a. 2 high availability Palo Alto firewalls

b. Approximately 6200

c. Approximately 52000

d. 111,424

QUESTION 56: What area of Cybersecurity is your primary focus (i.e. network detection and response? endpoint protection? etc).

ANSWER Google Workspace

QUESTION 57: Has there been a risk assessment completed and if so when was the last one completed? Was there a red, blue, and purple team type of risk assessment completed?

ANSWER No

QUESTION 58: Business continuity is listed within the objectives. Is conducting a business continuity and disaster recovery assessment of the current environment in scope, as that extends far beyond cybersecurity?

QUESTION 59: How large is your Google Drive/Workspace environment(s)?

ANSWER We have approximately 60,000 users in Google Workspace

QUESTION 60: What EDR technology is in place today?

QUESTION 61: Is your Microsoft licensing direct through Microsoft and do you have an Enterprise Agreement in place? Do you utilize Microsoft O365

Government Community Cloud (GCC)? Do you have a current EDR deployed within the environment? Trend Micro?

ANSWER A. Enterprise agreement B. No C. Cisco Secure Endpoint D. Trend Micro is not currently used in the district

QUESTION 62: Do you have a current MSP and/or MSSP? With that, do you have current NOC and SOC services/visibility? Are they 24/7?

ANSWER There is no current MSP or SOC

QUESTION 63: Understanding that there are ~6,500 employees, do most employees have workstations, laptops, and/or VDIs? Can any endpoint details be shared, including counts, OS, etc.?

ANSWER Server VMs 345

IOS 3400

MacOS 370 ChromeOS 91000 Windows laptops 8177

Windows desktops 8477

QUESTION 64: Are student devices in scope for endpoint protection? If so, can approximate details be shared, similar to the above?

ANSWER Student devices are not the focus of this RFP, but there are 91000

Chrome OS devices.

QUESTION 65: Can details be provided be provided about your hosting and infrastructure environments: on-prem data centers/shared hosting facilities/cloud, server counts and operating systems, network diagrams, current security devices and tools, etc.?

ANSWER The district has a self hosted data center. We are a Windows

Server environment with on-prem Active Directory. Staff users are provided Windows devices, while students are provided Chromebooks.

QUESTION 66: Expanding on the above, do you have a current asset inventory? Can that be shared with confidential information redacted (e.g., hostnames, IPs, etc.)?

ANSWER We are not providing an asset inventory at this time, QUESTION 67: Do you have an IT Asset Management Solution in place today? If yes, can details be provided?

ANSWER Incident IQ is used to manage IT assets

QUESTION 68: Do you have an IT ticketing system in place today? If yes, can details be provided?

ANSWER The district uses Incident IQ for IT ticketing.

QUESTION 69: Do you have a Zero Trust solution deployed? If so, what solution?

ANSWER Cisco/Palo Alto

QUESTION 70: Do you have a list of all business applications in use today, including priority/business impact (e.g., crown jewels identified)?

ANSWER No

QUESTION 71: Do you have current Incident Response Plan(s) in place today for critical systems?

ANSWER No

QUESTION 72: Integration with third-party systems is listed as a requirement. Can a list of third-party integrations be defined?

ANSWER There is no defined list at this time, put the proposed solution should have the capability to integrate with other 3rd party solutions.

QUESTION 73: Are any User Behavior Analytic (UBA) tools been deployed and in use today?

QUESTION 74: Do you currently have an IDS/IPS solution(s) deployed? If yes, can details be shared (subset of #9 above – security devices)?

QUESTION 75: Do you utilize Web Application Firewalls (WAFs)? If yes, can details be shared?

ANSWER Palo Alto

QUESTION 76: a. Number of endpoints by category (laptops, desktops, servers, mobile devices) and OS versions

b. Number and model/make of network devices (firewalls, routers, switches)

c. Number of email users in Google

d. Number of email users in M365

ANSWER a. 8177 Windows laptops, 8477 Windows desktops, 345 servers

b. 2 Palo Alto firewalls, 5730 Meraki access points, 1707 Cisco switches

c. Approximately 60,000

d. Microsoft 365 is not used for mail

QUESTION 77: The RFP states the District wants a unified dashboard capable of managing Endpoint, Email, Cloud, Network and OT Security. Can your provide details on what the District is currently using for Email Security, Cloud Security and OT Security?

ANSWER The district does not have these solutions in place currently.

QUESTION 78: The RFP states the District is seeking a 24/7/365 managed security service. Can you provide clarity on ownership of Security Technologies. Does the District want to own the technology, but have it managed or would it prefer to have the technology included as part of the service?

ANSWER The district is looking for the most effective and cost efficient solution that meets the technical requirements of the RFP.

QUESTION 79: What is the current internet bandwidth capacity at each of the 67 locations?

ANSWER Most locations have 2 redundant 1Gbps links.

QUESTION 80: Can you provide a high-level network topology diagram showing

WAN/LAN architecture?

ANSWER We are not providing network diagrams at this time.

QUESTION 81: What network equipment vendors are currently in use (switches, routers, firewalls)?

ANSWER Cisco/Meraki and Palo Alto

QUESTION 82: Are there any planned network infrastructure upgrades that could impact cybersecurity implementation?

ANSWER The district does plan to begin upgrading the network infrastructure of its school locations to Cisco Meraki 9300x switches in the coming months.

QUESTION 83: What is the current network segmentation strategy between administrative and instructional networks?

ANSWER Each location has its own subnet

QUESTION 84: Where are the primary data center(s) located, and what services are hosted locally vs. cloud?

ANSWER The primary data center is located in Jonesboro, GA. Email, ERP, SIS are web hosted. Active Directory and backups are on-prem.

QUESTION 85: Beyond Google Workspace, what other cloud services are in use across the district?

ANSWER Infinite Campus

QUESTION 86: What on-premise servers and applications require protection?

ANSWER All on-prem servers would require protection

QUESTION 87: Is there a disaster recovery site that needs to be included in the scope?

ANSWER There is a disaster recover site located in one of the district’s high school facilities.

QUESTION 88: What is the total count of district-owned devices by type

(Chromebooks, Windows laptops, tablets, etc.)?

ANSWER Server VMs 345

IOS 3400

MacOS 370 ChromeOS 91000

QUESTION 89: What is the estimated number of BYOD devices accessing district networks daily?

ANSWER We are not a BYOD environment

QUESTION 90: What is the ratio of student devices to staff devices?

ANSWER There are about 5 student devices to every one staff device

QUESTION 91: Are there any specialized devices (IoT, lab equipment, security cameras) that need protection?

ANSWER No

QUESTION 92: What Mobile Device Management (MDM) solution is currently in use?

ANSWER Workspace One

QUESTION 93: How are software updates and patches currently managed across devices?

ANSWER Workspace One

QUESTION 94: What is the device refresh cycle and are any major refreshes planned during the contract period?

ANSWER Device refreshes usually happen every 3 to 5 depending on funding and device type.

QUESTION 95: How long has the district been using Google Workspace and what is the current licensing level?

ANSWER The district has been using Google Workspace since 2014 and the current licensing level is Google Workspace for Education Fundamentals

QUESTION 96: What Google Workspace administrative controls and policies are currently configured?

ANSWER Through audits of our Google Workspace environment, we have aligned ourselves with best practices.

QUESTION 97: Are there any third-party applications integrated with Google

Workspace that need consideration?

ANSWER No

QUESTION 98: What file sharing and collaboration policies are currently in place?

ANSWER On-prem sharing is managed through group policy and folder permissions. Google Workspace sharing is based on groups and file/folder permissions

QUESTION 100: How are user accounts currently provisioned and managed?

ANSWER Currently user accounts are provisioned through Identity

Automation, however, the district is transitioning to ClassLink.

QUESTION 101: What is the current approach to managing student vs. staff access levels?

ANSWER Group Policy

QUESTION 102: Are there any single sign-on (SSO) solutions currently in place?

ANSWER Identity Automation, however, the district is transitioning to

ClassLink.

QUESTION 103: What specific FERPA compliance procedures must the cybersecurity solution support?

ANSWER Data Security and Confidentiality

QUESTION 104: Are there any state-specific privacy or security regulations beyond federal requirements?

ANSWER There is a district specific Data Privacy agreement that must be signed.

QUESTION 105: What audit and reporting requirements must the solution meet?

ANSWER Specific reporting and audit requirements have not been determined yet.

QUESTION 106: Are there any specific data residency or sovereignty requirements?

ANSWER Yes. Data must reside in the United States

QUESTION 107: What compliance frameworks is the district currently following (if any)?

ANSWER The district would prefer NIST

QUESTION 108: Are there any compliance gaps that the new solution needs to address?

ANSWER DLP and PII

QUESTION 109: What documentation and reporting is required for board meetings or state reporting?

ANSWER Specific documentation and reporting have not been defined yet.

QUESTION 110: What is the preferred implementation timeline considering the school calendar?

ANSWER A go-live date will be determined after FCDL issuance

QUESTION 111: Are there any blackout periods during the school year when changes cannot be made?

ANSWER During the state testing period in March/April

QUESTION 112: What summer break windows are available for major implementation activities?

ANSWER The district’s summer break usually occurs from late May to Late

July.

QUESTION 113: When does the district prefer to have the solution fully operational?

ANSWER A go-live date will be determined after FCDL issuance

QUESTION 114: How many IT staff members are available to support implementation and ongoing operations?

ANSWER There will be multiple team members that will be assisting with this implementation, but probably a core team of 4 to 5 IT staff members.

QUESTION 115: What is the current IT staffing level and planned changes?

ANSWER There are 49 staff members in the IT department. There are no planned changes at the moment.

QUESTION 116: What level of training will be required for IT staff, teachers, and administrators?

ANSWER Training would only be required for IT staff

QUESTION 117: Are there preferences for on-site vs. remote support?

ANSWER Implementation should be on-site. Ongoing support can be remote.

QUESTION 118: What level of automation is desired vs. manual control?

ANSWER Due to limited staff, automation is very important to the district.

QUESTION 119: Are there any specific reporting or dashboard requirements for administrators?

ANSWER The dashboard proposed should act as a single pane of glass for the entire solution being proposed.

QUESTION 120: Are there any incumbent vendors the district prefers to continue working with?

ANSWER We currently use Cisco Secure Endpoint (Cisco AMP) and Cisco

Umbrella which we prefer to retain due to familiarity and cost.

QUESTION 121: Are there any vendors the district specifically wants to avoid?

ANSWER No

QUESTION 122: What has been the district's experience with cybersecurity vendor support and service quality?

ANSWER The district has had both good and bad experiences with cybersecurity support in the past.

QUESTION 123: Will all 67 district schools receive full deployment, or is this limited to the schools listed in Appendix G?

ANSWER All 67 schools need to be protected/monitored

QUESTION 124: Are there specific network Segments or OT Systems included that require protection?

ANSWER All

QUESTION 125: Is there a defined cap for E-rate Cybersecurity Pilot Program (CPP) eligible funding per site or in aggregate?

ANSWER Schools and school districts are eligible to receive up to $13.60 per student annually on a pre-discount basis, subject to a $15,000 pre-discount, annual funding floor and a $1.5 million pre-discount, annual cap. The district expects around $2 million dollars in funding based on student population and need.

QUESTION 126: What are the expected timelines and milestones post-FCDL issuance?

ANSWER A go-live date will be determined after FCDL issuance

QUESTION 127: Which existing cybersecurity tools or SIEM solutions are currently deployed within CCPS? Are there any existing APIs, integrations, or legacy compatibility requirements?

Umbrella which we prefer to retain due to familiarity and cost.

QUESTION 128: Beyond cost and technical scoring, how much weight will be given to

FedRAMP or StateRAMP authorized solutions?

ANSWER FedRAMP and StateRAMP authorization are not scored

QUESTION 129: Will a functional demo or sandbox environment be requested during finalist evaluations?

ANSWER During the finalist evaluations, you will be given an allotted time to give a presentation which can include a demo if you see fit.

QEUSTION 130: Will CCPS perform its own penetration testing prior to award?

ANSWER If funding and timing allow.

QUESTION 131: It was stated on the precall that you are looking for annually penetration

Testing. Is that for internal, external and wireless? Do you want application testing as well? Additionally is the pentesting only for the Scope of this RFP or the entire CCPS district network.

ANSWER Pen testing is usually done on internal, external and wireless.

There are no internal applications that need to be tested. The scope of the RFP is what is required.

QUESTION 132: How many internet Circuits are there and what is the throughput for each of them?

ANSWER 3 10Gbps

QUESTION 133: Is this for the Scope of this RFP or the entire network? is this for servers or does it include workstations as well. Can you provide the totals numbers for servers and workstations?

ANSWER Please refer to the RFP for scope and requirements.

Server VMs 345

IOS 3400

MacOS 370 ChromeOS 91000

QUESTION 134: How many knowledge workers do you have?

ANSWER We have around 4800 knowledge workers

QUESTION 135: How many workstations do you have?

ANSWER 16654 Windows Endpoints

QUESTION 136: What is the percentage of workstation OS types?

ANSWER 96% Windows 10 / 4% Windows 11

QUESTION 137: How many servers do you have?

ANSWER 345

QUESTION 138: What is the percentage of server OS types?

ANSWER All of our servers are Windows servers.

QUESTION 139: How many physical locations do you have in each Geo region?

ANSWER We have a total of 73 locations in Clayton County.

QUESTION 140: Are you a current Microsoft 365 customer? If so, what are the Qty of licenses and types you own?

ANSWER Yes. Office 365 A1 Plus for students and Office 365 A1 Plus for faculty.

QUESTION 141: Are you using Microsoft Azure or Azure Gov, and if so please provide just a high-level summary about the workloads there.

ANSWER No

QUESTION 142: Are you using AWS or AWS Gov, and if so please provide just a high-level summary about the workloads there.

ANSWER No

QUESTION 143: How are you purchasing your Microsoft and Azure Consumption today?

ANSWER We do not use Azure

QUESTION 144: Do you already have an internal Infosec Team or SOC?

ANSWER No

QUESTION 145: How many SOC or SIEM team members do you have today?

ANSWER None

QUESTION 146: Do you have a current MSSP or MDR provider providing this service?

ANSWER No

QUESTION 147: Are you using a SIEM solution today? If so, which SIEM vendor are you using?

ANSWER No

QUESTION 150: Do you have any specific requirements or compliance reasons for needing a SIEM or Managed SIEM? If so, please share a high-level description.

ANSWER No

QUESTION 151: What is your average daily log ingestion amount (In GB or TB)

ANSWER None

QUESTION 152: Do you have any specific data retention requirements for SIEM Data?

(ex. 3 month live, 12 month archive)

ANSWER Not at this time

QUESTION 153 For SIEM Event Ingestion, which sources do you require?

a. Firewalls / WAF

b. EDR Agents

c. Microsoft Active Directory Severs

d. SSO platforms

e. Microsoft 365

f. Azure, Log Types (ex. Azure Activity, Azure AD, Azure DNS)

g. AWS, Log Types (ex. Cloudtrail, Cloudwatch, EC2)

h. SD-WAN

i. Other

ANSWER A thru E

QUESTION 154: Do you have an EDR solutions deployed, and if so which vendors?

ANSWER Cisco Secure Endpoint

QUESTION 155: How many endpoint agents for each EDR vendor?

ANSWER There are currently 16654 Windows endpoints

QUESTION 156: Endpoint

a. Are you looking for Full Disk Encryption and Removable Media Encryption?

b. Are you looking for End Point and Web DLP capabilities?

c. Do you have an interest in posture management capabilities?

d. Do you have an interest in automated patching and patch management?

ANSWER A. No B. Yes C. Yes D. Yes

QUESTION 157: External Penetration Testing Questions

a. Please provide a comprehensive list of external assets/IP ranges, including web applications, public-facing servers, and network infrastructure, that should be included in the scope of the penetration test.

b. Would you like us to perform Open-Source Intelligence on the company, including searching for any leaked credentials on the dark web? This involve expanding the attack surface by attempting to discover additional subdomains that the organization may not be aware of.

c. Are there any specific crown jewels (critical assets or sensitive information) that should receive heightened attention during the test?

d. Are there any mechanisms or security controls in place that we should take into consideration during the external penetration test?

e. Please provide any specific limitations or restrictions we should be aware of when conducting the external penetration test.

f. What are the preferred hours of work for the external penetration test? Are there any specific timeframes to avoid?

ANSWER A. We are not providing that information at this time B. Yes C. Yes D. Yes E. None at this time F. After usual business hours (8a – 5p)

QUESTION 158: Internal Penetration Testing Questions

a. How many servers and endpoints should be included in the scope of the internal penetration test?

b. Do you want us to perform authenticated testing (with credentials) on the internal systems?

c. Would you like us to conduct unauthenticated testing on the internal systems, simulating an attacker who has connected their computer to any available port in the network, using a Kali Linux machine?

d. Are there any specific crown jewels (critical assets or sensitive information) within the internal network that should be prioritized during the test?

e. Are there any limitations or restrictions we should be aware of when conducting the internal penetration test (e.g., certain IP ranges to be excluded from testing)?

f. Are there any specific areas or systems within the internal network that require extra attention during the penetration test?

g. Is it an Active Directory environment, Azure AD environment, or hybrid?

h. If Wi-Fi testing is included, how many SSIDs are there to test?

ANSWER A. 345 servers / 100 endpoints

B. Yes C. Yes D. Yes E. No F. Possibly G. On-prem AD

QUESTION 159: APP / API Penetration Testing Questions

a. How many APIs does your web application have that require testing? If possible, please provide a brief description or documentation for each API.

b. Could you specify the different roles within your web application?

For example, do you have roles such as admin, view-only, or any other specific roles that need to be considered during the penetration test?

c. How many interactive pages does your web application have? It would be helpful to know the approximate number of pages that require testing to ensure comprehensive coverage.

d. Are you able to provide documentation for the web application, including any relevant architecture diagrams or specifications?

e. Are there any specific compliance requirements or security standards that the web application needs to adhere to? This could include industry-specific regulations or internal security policies that our penetration test should consider.

f. Do you have any specific concerns or areas of focus for the penetration test? For example, are there particular vulnerabilities or attack vectors you want our team to prioritize?

g. Are there any testing restrictions or limitations we should be aware of? This could include restrictions on testing certain functionalities or specific timeframes during which the penetration test should be conducted.

ANSWER We do not have any on-prem applications that would need to be tested.

QUESTION 160: Award categories

a. Will you consider awarding sub-categories? For example, a different vendor for firewall versus MDR based upon your scoring criteria.

QUESTION 161: Email Security Licensing – Do you want licensing for:

a. Staff – user counts?

b. Student – user counts?

c. A single license for O365 and Gmail environments?

d. DLP (Data Loss Protection) – user counts?

e. Security Awareness Training – user counts?

ANSWER A. Approximately 6200 B. Approximately 52000 C. The district uses Gmail for its email solution D. Approximately 6200 E. None

QUESTION 162: Email Security

a. Would Unified email quarantine be beneficial?

b. What is your current email archiving product?

c. Would you like post-delivery remediation?

ANSWER A. Yes B. There is no specific email archive product in use C. Yes

QUESTION 163: What size firewalls are needed? i.e. what bandwidth?

ANSWER Firewalls were not requested. Please refer to page 56 of the RFP.

QUESTION 164: What quantity of firewalls are needed?

ANSWER Firewalls were not requested. Please refer to page 56 of the RFP.

QUESTION 165: How many endpoints are there for MDR?

ANSWER There are currently 16654 Windows endpoints

QUESTION 166: What type of endpoints do you have?

ANSWER There are currently 16654 Windows endpoints

QUESTION 167: How many IP addresses do you need to have for MDR?

ANSWER This question is not clear, but the district does 256 public IP addresses. However, not all are in use.

RFP 031-25 Cybersecurity Pilot Program 2025

Pre-Proposal Conference

Tuesday, July 8, 2025 at 2:00 P.M.

Via Zoom https://clayton-k12-ga-us.zoom.us/j/94795468137

Meeting ID: 947 9546 8137

One tap mobile

+14703812552, 94795468137# US (Atlanta)

Clayton County Public Schools Purchasing Department

1098 Fifth Avenue Jonesboro, GA 30236

Agenda

1. Opening Remarks Arnita Watson/Rose Tookes Purchasing Department

Purchasing Department

Purchasing Department

Introduction of CCPS Staff Purpose of the Meeting Procurement Process Required Forms Submission of Written Questions

2. Overview and Scope of Work

3. Questions and Answers

Department of Technology

Department of Technology

4. Conclusion and Adjournment Arnita Watson/Rose Tookes

Responses to this RFP will be received by Clayton County Public Schools (CCPS), Purchasing Department, in Bonfire until 3:00 P.M., Eastern Standard Time (EST) on Monday, August 11, 2025.

All questions or inquiries pertaining to the project are due no later than 3:00 p.m. on Thursday, July 10, 2025.

Submit questions in: Bonfirehub.com Portal at Vendor Discussions. All replies will be made in writing via addendum to the CCPS website. Oral responses are not authoritative. It shall be the responsibility of each Proponent to monitor the website and obtain a copy of any addendum issued for this RFP.

Bill Pitt/Robert Lacey

Bill Pitt/Robert Lacey

Arnita Watson/Rose Tookes https://claytonk12ga.bonfirehub.com/portal/?tab=openOpportunities mailto:purchasing@clayton.k12.ga.us

IFB 031-25

Cybersecurity Pilot Program 2025

Pre-Proposal Conference

Clayton County Public Schools 1098 Fifth Avenue

Jonesboro, GA 30236

Questions

Please print your question (s) below. Any question not answered today will be answered by addendum as stated below*

Name: Title:

Company/Firm:

Email Address:

*Attendees will be permitted to ask questions during the pre-proposal conference, however, any oral responses to questions are not authoritative and may not be relied upon for any matter. It shall be the responsibility of each Proponent to monitor BONFIRE and obtain a copy of any addendum issued for this RFP. Please do not contact the end user department for questions.

Exhibit 1

RFP 031-25

CYBERSECURITY PILOT PROGRAM

PRE-PROPOSAL CONFERENCE MEETING

JULY 8, 2025 at 2:00 PM

Name Title Company Name Contact Information

Arnita Watson Coordinating Supervisor CCPS – Purchasing arnita.watson@clayton.k12.g.us

Andy Kmiecik Global Solutions Group (GSG) andyk@globalsolgroup.com

Peter Cushley Digital Nomadic Solutions mohamed@digitalnomadicsolutions.com

Bobby Bitter Coro Cybersecurity Robert.bitter@coro.net

Nils Lindokken BlueAlly Technology Solutions aswain@blueally.com

Derrick Thomas

KD DYNAMIC SOLUTIONS

LLC derrick@kddynamicitsolutions.com

Andrew Chitty MGT Impact Solutions andrew.chitty@mgt.us

Bruce Reese Budget Analyst Clayton County Public Schools Bruce.reese@clayton.k12.ga.us

Greg DeLeonardis Client Solution Manager Echelon Risk + Cyber greg.deleonardis@echeloncyber.com

Nehal Mehta GEOAcl LLC DBA Rainbow Secure, Nehal@rainbowsecure.com

Danilo Petrovic UncommonX dpetrovic@uncommonx.com

Peter Cushley Braxton-Grant Technologies, INC pcushley@braxtongrant.com Darshana Shah Global Solution Group

Darshanas@globalsolgroup.com mailto:arnita.watson@clayton.k12.g.us

Exhibit 1

Name Title Company Name Contact Information

Luke McClain BlueAlly lmcclain@blueally.com

Kathrin Barber-Clark Vice President IOTECH Consulting, LLC kbarberclark@iotechconsulting.com

Robert Young MGT Impact Solutions, ryoung@mgt.us

George Rasasombath Coordinator of Technical Operations George.rasasombath@clayton.k12.ga.us

Arshadul Mahi Aspire Tech Services And Solutions Corp. arshadul.mahi@aspiretss.com

Christian Noreika Arctic Wolf, Christian.noreika@arcticwolf.com

Manoj Kumar Global Solutions Group manojkm@globalsolgroup.com

Lilian Omotosho 4 Degrees Consult liliano@4degreesconsult.com

Sean Robbins KronoSoft LLC info@krono-soft.com

Abdul Wajid Credo US Abdul.Wajid@Credots.com

Reuel Murray BlueAlly Technology Solutions rmurray@blueally.com

Belinda VanZant Digital Nomadic Solutions belinda.vanzant-perez@digitalnomadicsolutions.com