9._Exhibit_C_C5-CMCS-G1_533_EDR_Tech_SOW_063026.docx

Bidder’s Name

INVITATION FOR BID

IFB C5-CMCS-G1-26

CALNET Managed Cybersecurity Services

CATEGORY 533 – MANAGED ENDPOINT DETECTION AND RESPONSE SERVICE

<Enter Bidder Name Here> Statement of Work

TECHNICAL REQUIREMENTS

JUNE 30, 2026

Issued by:

STATE OF CALIFORNIA

Office of Statewide Technology Procurement PO Box 1810 Rancho Cordova, CA 95741 Disclaimer: The original PDF version and any subsequent addenda to this IFB remain the official version. In the event of any inconsistency between the Bidder’s versions, articles, attachments, exhibits, specifications, or provisions, which constitute the Contract, the official State version of the IFB in its entirety shall take precedence.

ADDENDUM LOG

Table of Contents

Statement of work TECHNICAL REQUIREMENTS Category 533 Managed Endpoint Detection and Response Service

533.1 OVERVIEW

The California Department of Technology (CDT), Office of Statewide Technology Procurement (OSTP) is requesting proposals from responsive Bidders to provide Managed Endpoint Detection and Response (EDR) Services and Features.

This Invitation for Bid (IFB) C5-CMCS-G1-26 Category 533 provides the State’s solicitation for best value solutions for Managed EDR Service. This IFB also describes the technical Requirements necessary to support the CALNET Program Requirements.

This IFB will be awarded to Bidders that meet the award criteria as described in IFB C5-CMCS-G1-26 Part 1, Bid Evaluation. The CALNET 5 CALNET Managed Cybersecurity Services (CMCS) Contract(s) that result from the award of this IFB will be managed on a day-to-day basis by CALNET Management and Oversight (CMO).

533.1.1 Bidder Response Requirements

Throughout this IFB, the Bidder is required to confirm their understanding and acceptance of the Requirements by selecting a response in the provided drop-down field.

Example:

“The Bidder understands and shall meet or exceed the Requirements identified in Section 533.X Section Name? Choose an item.”

533.1.2 Designation of Requirements

All technical Requirements specified in this IFB are mandatory and must be responded to as identified in IFB Part 1, SOW mandatory technical Requirements by the Bidder. Additionally, some mandatory Requirements are “Mandatory-Scorable” and are designated as “(M-S).”

533.1.3 Statewide Policies and Standards

The Contractor’s Managed EDR Service shall be aligned with policies and standards set forth in the Statewide Information Management Manual (SIMM) Section 5300, Information Security (SIMM 5355-A Endpoint Protection Standard).

533.1.4 Pacific Time Zone

Unless specified otherwise, all Requirements are stated in the Pacific Time Zone and the Contractor shall use the Pacific Time Zone.

The Bidder understands and shall meet or exceed the Requirements identified in Section 533.1 Overview? Choose an item.

533.2 MANAGED ENDPOINT DETECTION AND RESPONSE SERVICE

The Contractor shall provide Managed EDR Services and Features that deliver 24x7x365 monitoring, detection, and automated or guided response to threats occurring on endpoint devices. The Contractor’s Managed EDR Service shall include full provisioning, configuration, and onboarding of endpoint agents across supported Customer devices.

The Contractor’s Managed EDR Service shall protect traditional computing endpoints such as desktops, laptops, servers, and virtual machines located on-premises, remote, or operating in cloud environments through a combination of software agents, analytics engines, and centralized management tools. In addition, the Managed EDR Service shall support visibility and security monitoring for non-traditional endpoints, including Internet of Things (IoT) devices and Operational Technology (OT) assets, where feasible and applicable.

The Contractor shall provide technical support, troubleshooting, and root-cause analysis; conducts regular testing, optimization, and tuning of detection logic; and validates performance against defined Service Objectives. The Contractor shall also provide Customer training and knowledge transfer for dashboard usage, alert handling, and monthly reporting, governance participation, and access to required audit and performance documentation.

All Services shall be delivered in accordance with industry best practices and applicable regulatory Requirements.

533.2.1 Managed EDR Services and Features

The Contractor’s Managed EDR Service shall integrate into directory and device management systems. The Contractor shall provide 24x7x365 monitoring of endpoint telemetry and behavioral analytics, applying both automated and manual threat detection aligned to the MITRE Adversarial Tactics, Techniques, and Common Knowledge (MITRE ATT&CK) framework.

The Contractor’s Managed EDR Service shall include the following Features and functionalities at a minimum.

533.2.1.1 Managed EDR Detection and Protection Capabilities

Utilize both signature and signature-less detection and prevention techniques;

Provide real-time on-agent prevention and detection, without the need for constant remote connectivity or updates;

Detect and prevent memory-based and/or file-less attacks;

Support common Security Information and Event Management (SIEM) integrations via open Application Programming Interface (API);

Provide a centralized software distribution process for updates or integration with an existing distribution solution; and, Detect and report unmanaged endpoints (rogue endpoints), defined as endpoints not onboarded to or reporting to the EDR platform but identified through EDR telemetry; detection is limited to visibility and reporting and excludes network access control or enforcement functions.

533.2.1.2 Managed EDR Investigative Support Capabilities:

Include historical timeline details across all monitored endpoints;

Provide investigative scanning capabilities;

Root cause assessment information; and, Provide analysis and reporting tools.

The Contractor’s Managed EDR Service shall remotely isolate devices, terminate malicious processes, and retrieve forensic data for review. All actions and responses must be logged and retained in accordance with state data retention requirements to ensure transparency and compliance tracking.

533.2.1.3 Managed EDR Containment Capabilities:

Contain an incident at the endpoint via automated actions;

Quarantine an affected system from the rest of the enterprise network via APIs, manual intervention, or automatically as required; and, Quarantine specific processes and malicious artifacts.

533.2.1.4 Managed EDR Remediation Capabilities:

Remediate endpoints to pre-infection state;

Remove malicious filles;

Roll back and repair changes; and, Create necessary files to be deployed by system management tools.

533.2.1.5 Managed EDR Deployment Models

The Contractor’s Managed EDR Service shall include a centralized management console and support various deployment models, including software-only, cloud-hosted, on premises, or hybrid options. The Contractor shall identify the deployment models available in the table 533.2.1.5.a Managed EDR Deployment Models below.

Table 533.2.1.5.a – Managed EDR Deployment Models

The Contractor shall provide the Managed EDR Service listed in Table 533.2.1.a. below. The Contractor’s pricing shall be based on a per endpoint, per-month, subscription-based model.

Additional volume pricing options may be added to the Contract after Contract Award via the formal amendment process, in accordance with SOW Business Requirements Section CMCS-G1.10 (Contract Amendments).

Table 533.2.1.a – Managed EDR Service

Service

Service

Service

Service

Service

533.2.2 Managed EDR Service System Resource Allocation (M-S)

The Contractor’s Managed EDR Service shall ensure minimal impact on Customer systems resources. The Contractor shall provide a commitment level to system memory (MB of RAM) and CPU allocation for steady-state operation (not during an active incident remediation) in Table 533.2.2.a below.

Table 533.2.1.7.a – Contractor’s EDR System Resource Allocation

(B, S or P)

533.2.3 Additional Managed EDR Services and Features

533.2.3.1 Managed EDR Configuration and Implementation Consulting Services Managed EDR Consulting Services shall only be utilized in conjunction with the Services and Features listed in Category 533 – Managed Endpoint Detection and Response Service. These Consulting Services are for custom Managed EDR Service implementations that exceed the basic elements necessary to configure an instance of a working Managed EDR Service as defined by General Provisions – Telecommunications, Section 15.12, Goods and Services Costs.

533.2.3.1.1 Planning and Design

The Contractor shall provide planning and design consulting Services to assist Customers with:

Gathering detailed technical, operational, and regulatory Requirements to guide advanced or customized Managed EDR deployments.

Designing end to end solution architecture defining how the managed EDR service will interoperate with the Customer’s identity, security, network, cloud, and endpoint environments.

Developing platform migration strategies including:

Assessing the Customer’s existing EDR or endpoint security platform.

Identify gaps, dependency constraints and compatibility considerations.

Define coexistence and transition periods, rollout sequencing, and rollback options.

Develop a comprehensive transition plan for migrating from the Customer’s current platform to the Managed EDR Service.

Designing integration approaches for external system such as SIEM, SOAR, IAM, MDM, vulnerability management tools, threat intelligence platforms, logging systems, or ticketing platforms.

Document application and system dependencies, endpoint classifications, data flows, integration prerequisites for complex or distributed environments.

Planning telemetry capacity, event ingestion rates, and retentions periods.

Review and document endpoint security posture, hardening standards, and alignment with policies and requirements.

Designing operational workflows and escalation processes for alert triage, case management Producing documentation, architectural diagrams, migration plans, and implementation roadmaps for Customer review and approval.

533.2.3.1.2 Implementation and Configuration

The Contractor shall provide implementation and configuration consulting Services to assist Customers with:

Engineering and advanced deployment activities, including custom software packaging, scripted installations, or specialized deployment approaches for complex endpoint environments.

Executing platform migration tasks:

Removal or deactivation of legacy EDR agents following the approved migration plan.

Deployment of new EDR agents following the approved migration plan Transitioning detection rules, policies or integrations from the legacy platform where applicable.

Advanced configuration engineering, including creation of custom detection logic, specialized behavioral rules, and Customer specific automated response workflows.

Designing complex integrations that require engineering level support such as API based data exchanges, SOAR playbooks, custom correlation logic, or workflow automations.

Developing custom dashboards, analytic views, or reporting model beyond standard reports.

Documenting configurations, custom rule sets, integration details, deployment procedures, and post migration operational guideline resulting from the consulting engagement.

533.2.3.1.3 Threat Hunting and Forensics

The Contractor shall provide threat hunting and forensics consulting Services that go beyond the required managed Services to assist Customers with:

Performing proactive investigations, using threat intelligence and targeted analysis, to identify threats not detected by routine monitoring.

Performing forensic investigations, including collection and analysis of endpoint artifacts, memory data, process activity, and historical telemetry.

Conducting retrospective reviews of historical endpoint activity to identify indicators of zero-day vulnerabilities, active threat campaigns, or other suspected compromise events.

Preserving and handling digital evidence in accordance with chain-of-custody requirements for audit, compliance, or potential law-enforcement purposes.

Preparing investigative reports summarizing event timelines, root-cause analysis, observed adversary tactics and techniques, impacted assets, and recommended remediation actions.

Providing recommendations to improve endpoint security posture, detection logic, operational workflows, and incident response procedures based on investigative findings The Contractor shall offer Consulting Services in Table 533.2.3.1.a Table 533.2.3.1.a – Managed EDR Consulting and Implementation Services

Service

Service

Service

533.2.4 Managed EDR Geographic Service Area

The Contractor shall provide their Managed EDR Service statewide.

The Bidder understands and shall meet or exceed the Requirements identified in Section 533.2 Managed Endpoint Detection and Response Service? Choose an item.

533.3 SERVICE LEVEL AGREEMENTS (SLA)

The Contractor shall provide Service Level Agreements (SLAs) as set forth below. The intent of this section is to provide Customers, the CALNET Program and the Contractor with Requirements that define and assist in the management of the SLAs. This section includes the SLA formats, general Requirements, Stop Clock Conditions, and the Technical SLAs for the Services identified in this solicitation.

533.3.1 Service Level Agreement Format

The Contractor shall adhere to the following format and include the content as described below for each Technical SLA added by the Contractor throughout the Contract Term:

SLA Name – Each SLA Name must be unique;

Definition - Describes what performance metric will be measured;

Measurements Process - Provides instructions on how the Contractor will continuously monitor and measure SLA performance to ensure compliance. The Contractor shall provide details describing how and what will be measured. Details should include source of data and define the points of measurement within the system, application, or network;

Service(s) - All applicable Services will be listed in each SLA;

Objective(s) – Defines the SLA performance goal/parameters; and, Rights and Remedies Per Occurrence: Rights and remedies are paid on a per event basis during the bill cycle; and, Monthly Aggregated Measurements: Rights and Remedies (as set forth below) are paid once during the bill cycle based on an aggregate of events over a defined period of time.

The Contractor shall proactively apply a credit or refund when an SLA Objective is not met. CALNET SLA Rights and Remedies do not require the Customer to submit a request for credit or refund.

533.3.2 Technical Requirements versus SLA Objectives

Sections 533.2 (Managed Endpoint Detection and Response Service) define the technical Requirements for each Service. These Requirements are the minimum parameters each Bidder must meet to qualify for Contract Award. Upon Contract award the committed technical Requirements will be maintained throughout the remainder of the Contract.

Committed SLA Objectives are minimum parameters which the Contractor shall be held accountable for all Rights and Remedies throughout the Contract Term.

533.3.3 Methods of Outage Reporting: Customer or Contractor

There are two methods in which CALNET Service failures or quality of Service issues may be reported and Contractor trouble tickets opened: Customer reported, or Contractor reported.

The first method of outage reporting results from a Customer reporting Service trouble to the Contractor’s Customer Service Center via phone call, opening of a trouble ticket, or through the Contractor’s portal.

The second method of outage reporting occurs when the Contractor opens a trouble ticket as a result of network/system alarm or other method of Service failure identification. In each instance the Contractor shall open a trouble ticket and monitor and report to Customer until Service is restored.

533.3.4 Response to Service Level Agreements

Many of the Service Level Agreements described below include multiple Objective levels – Basic, Standard and Premier. Bidders shall indicate one specific Objective level they are committing to for each Service in the space provided in the “Objective” section of each SLA description.

533.3.5 Contractor SLA Management Plan

Within 90 calendar days of Contract Award, the Contractor shall provide the CALNET Program with a detailed SLA Management Plan that describes how the Contractor will manage the Technical SLAs for Services in this IFB. The plan will be updated as needed by the Contractor and the State throughout the Contract Term. The SLA Management Plan shall define the following:

Contractor SLA manager and supporting staff responsibilities;

Contractor’s process for measuring Objectives for each SLA. The process shall explain how the Contractor will continuously monitor and measure SLA performance to ensure compliance. The Contractor shall provide details describing how and what will be measured. Details should include source of data and define the points of measurement;

Creation and delivery of SLA Reports;

SLA invoicing credit and refund process;

Contractor SLA problem resolution process for SLA management and SLA reporting. The Contractor shall provide a separate process for Customers and CALNET Program;

Contractor SLA Manager (including contact information) to manage all SLA compliance and reporting; and, The Contractor shall include SLA Manager contact information for SLA inquiries and issue resolution for Customer and CALNET Program.

533.3.6 Technical SLA General Requirements

The Contractor shall adhere to the following general Requirements which apply to all CALNET Technical SLAs (Section 533.3.8):

With the exception of the Provisioning SLA (Section 533.3.8.3), the total SLA rights and remedies for any given month shall not exceed the sum of 100% of the Total Monthly Recurring Charges (TMRC);

If a Service fails to meet one or more of the performance Objectives, only the SLA with the largest monthly Rights and Remedies will be credited to the Customer, per month;

The Contractor shall apply CALNET SLAs and Rights and Remedies for Services provided by Subcontractors and Affiliates;

The Definition, Measurement Process, Objectives, and Rights and Remedies shall apply to all Services identified in each SLA. Exceptions must be otherwise stated in the SLA;

TMRC Rights and Remedies shall include the Service, option(s), and Feature(s) charges.

The Contractor shall proactively and continuously monitor and measure all Technical SLA Objectives.

The Contractor shall proactively credit all Rights and Remedies to the Customer within 60 calendar days of the trouble resolution date on the trouble ticket or within 60 calendar days of the Due Date on the Service Request for the Provisioning SLA.

To the extent that the Contractor offers additional SLAs, or SLAs with more advantageous rights and/or remedies for the same or similar services offered through tariffs, online service guides, or other similarly situated government contracts (Federal, State, County, City), the State will be entitled to the same rights and/or remedies therein. The Contractor shall present the SLAs to CALNET Program for possible inclusion via amendment;

The Contractor shall apply CALNET 5 CMCS SLA Rights and Remedies to Services provided in all areas the Contractor provides Service;

The election by CALNET Program of any SLA Rights and Remedies covered by this Contract shall not exclude or limit CALNET Program or any Customer's Rights and Remedies otherwise available within the Contract or at law or equity;

The Contractor shall apply Rights and Remedies when a Service fails to meet the SLA Objective even when backup or protected Services provide the Customer with continuation of Services;

The Contractor shall act as the single point of contact in coordinating all entities to meet the State’s needs for provisioning, maintenance, restoration and resolution of Service issues or that of their Subcontractors and Affiliates under this Contract;

The Customer Escalation Process and/or the CMO Escalation Process shall be considered an additional Right and Remedy if the Contractor fails to resolve Service issues within the SLA Objective(s);

Trouble reporting and restoration shall be provided 24x7 for CALNET Services;

SLAs apply 24x7 unless the SLA specifies an exception;

The Contractor invoices shall clearly cross reference the SLA credit to the Service ID in accordance with SOW Business Requirements Section CMCS-G1.5 (Invoicing);

The Contractor shall provide a CALNET 5 CMCS SLA Manager responsible for CALNET 5 CMCS SLA compliance. The SLA Manager shall attend regular meetings and be available upon request to address CALNET Program SLA oversight, report issues, and problem resolution concerns. The CALNET 5 CMCS SLA Manager shall also coordinate SLA support for Customer SLA inquiries and issue resolution; and, The Contractor shall provide Customer and CALNET Program support for SLA inquiries and issue resolution.

533.3.7 Trouble Ticket Stop Clock Conditions

Only the following conditions shall be allowed to stop the duration of the Service Level Agreements. The Contractor shall document durations using the Stop Clock Condition (SCC) listed in Table 533.3.7, which must include start and stop time stamps in the Contractor’s trouble ticket reporting tool or Contractor’s provisioning service request tool for each application of a SCC.

The Contractor shall not consider “cleared while testing” or “no trouble found” as a SCC.

The Contractor observation timeframes, not requested by End-User, after incident resolution shall not be included in Outage Duration reporting.

Table 533.3.7 – Stop Clock Conditions

Access necessary to correct the problem is not available because access has not been arranged by site contact or End-User representative;

Site contact refuses access to technician who displays proper identification;

The Customer provides incorrect site contact information which prevents access, provided that the Contractor takes reasonable steps to notify End-User of the improper contact information and takes steps to obtain the correct information; or, Site has limited hours of business that directly impacts the Contractor’s ability to resolve the problem.

If it is determined later that the cause of the problem was not at the site in question, then Access SCC shall not apply.

533.3.8 Technical Service Level Agreements (SLAs)

The Contractor shall provide and manage the following Technical SLAs.

533.3.8.1 Service Availability (M-S)

SLA Name: Service Availability Definition:

The percentage of time a CALNET Managed Endpoint Detection and Response Service is Fully Functional and available for use each calendar month.

Measurement Process:

The monthly Availability percentage shall be calculated using the following formula:

((Scheduled Uptime – Unavailable Time) / Scheduled Uptime) x 100% Unavailable Time shall be calculated on the accumulative total of all Unavailable Time derived from all trouble tickets closed for the affected Service ID per calendar month. All Unavailable Time applied to other SLAs which result in a Remedy will be excluded from the monthly accumulated total.

The Service Availability calculation shall exclude approved Contractor or Customer scheduled maintenance windows.

Services:

Managed Endpoint Detection and Response Service Objectives:

The objective will be based on the service Type identified in the table below:

(B, S or P)

Rights and Remedies:

Per Occurrence:

N/A Monthly Aggregated Measurements:

The first month the Service fails to meet the committed SLA objective shall result in a 25% credit or refund of the TMRC.

The second consecutive month the Services fails to meet the committed SLA objective shall result in a 35% credit or refund of TMRC.

Each additional consecutive month the Service fails to meet the committed SLA objective shall result in a 50% credit or refund of the TMRC.

533.3.8.2 Threat Mitigation (M-S)

SLA Name: Threat Mitigation Definition:

The maximum time allowed for the Contractor’s Managed EDR Service to detect a security event and fully resolve the incident through containment, remediation, and mitigation.

Measurement Process:

The Mitigation time is measured from the time a security event is detected by the Contractor’s system or reported by the Customer to the time the Contractor has provided containment, remediation, or a formally accepted corrective action plan is completed and agreed to in writing by the Customer.

The Contractor’s Threat Mitigation Measurement Process shall include all activities from initial detection to threat mitigation as described below:

Time to Detect = Time for Contractor to detect a security event Time to Acknowledge = Time for Contractor to acknowledge an alert and respond to the security incident Time to Recover = Time for Contractor to recover and return Service to fully functional Services:

Managed Endpoint Detection and Response Service Objectives:

The Objective Threat Mitigation time will be:

(B, S or P)

Rights and Remedies:

Per Occurrence:

50% credit or refund of the TMRC for each End-User Service not meeting the committed Objective.

Monthly Aggregated Measurements:

N/A

533.3.8.3 Provisioning (M-S)

SLA Name: Provisioning Definition:

Provisioning shall include new Services, moves, adds, changes, and disconnects/deletes, completed by the Contractor on or before the due dates. The Provisioning SLA shall be based on committed installation intervals established in this SLA or due dates negotiated between the Customer and the Contractor documented on the Contractor’s order confirmation notification or Managed Project Work, Scope Of Work, in accordance with SOW Business Requirements Section CMCS-G1.3.3, Provisioning and Implementation. The Contractor shall meet the committed interval dates or due date negotiated with the Customer. If the Customer agrees to a negotiated due date, the negotiated due date supersedes the committed interval. At the Customer’s discretion, if the scope of the Service Request(s) meets the Managed Project criteria, negotiated due dates will be established and documented in the Project Timeline per SOW Business Requirements Section CMCS-G1.14.1, Managed Project Work General Requirements.

Features must be installed in conjunction with the Service except when listed below.

Provisioning SLAs have two Objectives:

Objective 1: Individual Service installation; and, Objective 2: Successful Install Monthly Percentage by service type.

Note: Provisioning timelines include extended demarcation wiring when appropriate.

Measurement Process:

Objective 1: Individual Service Installations:

Install intervals are based on the committed installation intervals established in this SLA or due dates negotiated between the Customer and the Contractor. This Objective requires the Contractor to meet the due date for each individual Service installation. This includes individual Service installations for Managed Projects.

Objective 2: Successful Install Monthly Percentage per Service Type:

The Contractor shall sum all individual installations per Service, as listed below, meeting the Objective in the measurement period and divide by the sum of all individual Service installations due per Service in the measurement period and multiply by 100 to equal the percentage of Service installations completed on time. The Contractor must meet or exceed the Objective below in order to avoid the Rights and Remedies.

Services:

Managed Endpoint Detection and Response Service Objectives:

Objective 1: Individual Service installation: Service provisioned on or before the due date per installation Service Request.

Objective 2: Monthly Average percent by Service Type:

(B or P)

Rights and Remedies:

Per Occurrence:

Objective 1: Individual Service installations: 50% of installation fee credited to the Customer for any missed committed Objective.

Monthly Aggregated Measurements:

Objective 2: 100% of the installation fee credited to the Customer for all Service installations (per Service Type) that did not complete within the committed Objective during the month if the Successful Install Monthly Percentage is below the committed Objective.

533.3.8.4 Service Enhancement SLAs

All Service enhancements shall be considered a Feature of the Service and therefore shall be included as such under the SLAs.

533.3.8.5 Non-Mandatory Service Offerings

The Contractor shall provide SLAs as defined in SLA Section 533.3.8 for each Service added after Contract Award via Contract amendment that is determined by the CALNET Program not to be a Feature of a Service or a component of an unbundled Service. SLA tables shall be amended at time of Contract amendment to include all new Services.

533.3.8.6 Contract Amendment Service Enhancement SLAs

All Contract amendments for Service enhancements shall be considered a Feature of the Service, therefore included as such under the SLAs as defined in Section 533.3.

The Bidder understands and shall meet or exceed the Requirements identified in Section 533.3 Service Level Agreements (SLA)? Choose an item.