APPENDIX A- 26-26.xlsx

This appendix document outlines the detailed requirements and functions for the University of Southern Mississippi's managed cybersecurity services procurement (Solicitation 9280-26-R-IFBD-00029). The university seeks an enterprise-grade managed cybersecurity solution delivering 24/7 threat prevention, detection, investigation, and response capabilities across approximately 9,500 active users, 300 servers, and cloud-based infrastructure. The vendor must provide a comprehensive managed service—not solely software—including an initial cybersecurity assessment evaluating identity and access controls, email security, endpoint security, server security, and cloud workloads, with documented findings and recommendations for university approval prior to implementation. Required services encompass identity and access security with multi-factor authentication and conditional access controls, email and collaboration security protecting against malware, spam, and phishing threats, endpoint detection and response for workstations and managed devices, server and cloud workload monitoring with vulnerability assessment and threat detection, a staffed Security Operations Center providing human-led investigation and response, centralized SIEM with log collection and analytics, and penetration testing services. The sealed bid submission deadline is Monday, March 9, 2026, at 2:00 p.m. Central Time at Bond Hall, Room 214, Hattiesburg, Mississippi, with vendor questions due by 5:00 p.m. CST on March 3, 2026, and written responses provided by addendum no later than March 5, 2026. The university seeks a three-year agreement with potential two additional one-year renewals.

Vendors must demonstrate Microsoft alignment as verified Managed Security Services Providers through membership in the Microsoft Intelligent Security Association, Microsoft Security Partner Designation, Microsoft MDR/MXDR partner status, or documented security specializations, and must provide minimum three customer references from implementations within the last 12 months, preferably from higher education institutions. The vendor must maintain documented disaster recovery and business continuity plans, notify the university of confirmed high-severity incidents within seventy-two hours of discovery, maintain protected audit logs of administrative access and configuration changes, and return all university security data in non-proprietary format upon contract termination. Proposals will be evaluated on a 100-point scale with weightings of 45 points for Cost, 40 points for Requirements, and 15 points for Implementation Schedule. No specific budget range or award value is disclosed in the available solicitation documents, and no incumbent vendors or current contractors are identified. Annual invoicing is requested with payment processed within 45 days of invoice receipt in accordance with Mississippi Code Section 31-7-305. The solution must comply with the Mississippi Department of Information Technology Services' State Enterprise Cloud Offsite Internet Hosting Security Policy.