7-QA 4.pdf
PDF 109 KB Posted
- Attached to
- 26-005 Erate - SEIM/SOC/XDR solution
- Solicitation number
- 26-005 - RFP - SEIM/SOC/XDR solution
- Issued by
- Bibb County, Georgia
About this file
This document is a Q&A document for Bibb County School District's Erate SIEM/SOC/XDR Solution (Project 26-005), seeking a cybersecurity solution for monitoring approximately 35,000 endpoints across 42 school locations. The district currently uses Microsoft Sentinel and is looking to implement or upgrade its Security Information and Event Management (SIEM), Security Operations Center (SOC), and Extended Detection and Response (XDR) capabilities. The implementation timeline is contingent on Erate funding approval, and the solution must integrate with existing tools like Microsoft Defender and Palo Alto Firewalls.
The current technology environment includes a mixed Windows, Chrome, and MAC ecosystem with 98% of endpoints managed through Intune and Google Admin Console. The district utilizes Microsoft 365 with A5 licensing, cloud services, and follows NIST security frameworks with standard state and federal K12 compliance requirements. The proposed solution should be deployed and set up by a third-party vendor, with day-to-day incident management handled internally, but with escalation notifications and some automated threat responses. Key technical requirements include monitoring on-network and off-network devices, integrating with existing log sources like M365, Defender, ISP, Palo Firewill, Cisco switches, and Meraki switches and access points, with bandwidth of 14gbps shared across 42 sites.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 1-Bid Forms EMW.pdf | ||
| 6-QA 3.pdf | ||
| 2-Final Contract Procurement 2023 FINAL SampleFILE.pdf | ||
| 5-QA 2.pdf | ||
| 8-QA 5.pdf | ||
| 3-RFP 26-005 SEIM-SOC-XDR solution.pdf | ||
| 4-QA.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Q & A_4 26-005
ERATE SEIM_SOC_XDR Solution
How many total endpoints (laptops, desktops, servers) will need to be monitored?
Roughly 35k
Are there any virtual or cloud-based servers included in the environment? Yes
How many school buildings or locations are in scope for coverage? 42
Do you currently have a SIEM/SOC/XDR solution in place, or is this a new implementation? MS Sentinel
Are there any existing tools this solution should integrate with (e.g., firewalls, antivirus)? MS Defender, Palo Alto Firewalls: 2 - PA5220
What’s the expected implementation timeline once a vendor is selected? As soon as erate funding is approved
Will the chosen vendor be expected to assist with Erate documentation or filings?
Vendors must follow erate procedures
Is it a windows environment? Chrome? MAC? All 3
What is the current cybersecurity posture and existing security tooling? (e.g., existing antivirus, firewalls, intrusion detection systems, email security, web filters, identity management solutions) MS Defender (Cloud and Endpoint), Palo Firewalls, Lightspeed web filter
What specific data sources (logs) are currently available or expected to be ingested into the SIEM? Any that can be, but primarily M365, Defender, ISE, Palo Firewill, Cisco switches, Meraki Switches and APs
What is the estimated daily volume of logs (in GB or EPS - Events Per Second) from each key source, if known? Not known
Are there existing threat intelligence feeds the district currently subscribes to that need to be integrated? Unknown at this time
Are all endpoints currently managed (e.g., via MDM, RMM)? 98% are
Are there any "off-network" devices (e.g., student personal devices using Wi-Fi, staff laptops used at home) that need to be monitored? Student and staff devices are used at home
Are there any specific requirements for the type or nature of these honeypots/deception elements? Vendor discretion
Is there an existing ITSM/ticketing system that needs to be integrated with, or will your system be the primary one for security incidents? No
Are these external-facing public IPs, or do they include internal segments? Not 100% sure of question, but we do have external-facing public IPs
What is the desired escalation matrix for incidents? Whatever is industry standard
Does the district have existing endpoint protection agents that need to be replaced, or will your XDR agent be the primary one? Vendor description
What is the expectation for "after hours" monitoring and management of the endpoints (e.g., patching, policy enforcement, active threat hunting)? Notifications and escalation for mission critical issues
Are there any existing APIs or data sources that the district would like to integrate with the solution beyond typical security logs? (e.g., HR systems for user context, asset management systems) No
What is the internet bandwidth available at each school and the central district office? (Important for data ingestion into a hosted solution). 14gbps internet shared with 42 sites, each sites connected to WAN at 10gbps
What are the district's requirements for data retention for logs and forensic data?
Whatever is industry standard
Do you currently have an IT Management System for tracking tickets and if so, who is the solution provider? IncidentIQ
Do you have any other security related tools as it relates to the network, email, cloud or the endpoint? MS Defender
How do you currently manage your endpoints? Intune, Google Admin Console
Do you use any Mobile Device Management (MDM) products? Intune
What software agents are currently deployed to your endpoints? Intune, Lightspeed, Defender
Do you utilize any public, private or community cloud providers? A mixture of all
Do you use any Microsoft/Azure Services and if so which services? M365 with A5, Sentinel
Do you currently utilize any security frameworks such as CIS or NIST? NIST
Do you have any compliance requirements? Standard state and federal that are applicable to K12 institutions
Do you require external penetration testing or external vulnerability scanning and reporting for the 1000 IP addresses? Vendor discretion
Do you have Cybersecurity Insurance? Yes
Do you currently have a Breach Incident Retainer in the event of a major incident and if so with which provider? No
If you do not have a Breach Incident Retainer, are you looking for it to be included in the proposed solution? No
Do you have a central identity provider (IdP) or identity management solution i.e.
Entra ID, Okta, Active Directory? Entra
Do you use a SIEM today for log ingestion? And if so, what is your current log ingestion rate? MS Sentinel, unknown at this time
Is the intent of the RFP for Bibb County School District to outsource the SIEM/SOC/XDR for a fully managed solution? Are all components (honeypot/decepter, traffic monitoring, etc.) to be included in third party managed service? Deployed and setup by 3rd party, day to day incidents handled by BCSD but escalation notifications for mission critical alerts with some automated responses to threats
Is the intent of the RFP for Bibb County School District to outsource the SIEM/SOC/XDR for a fully managed solution? Are all components (honeypot/decepter, traffic monitoring, etc.) to be included in third party managed service? Duplicate to above
File details come from the government source that posted it. Updated .