Document-1790003806857.pdf

Managed Security Services Provider (MSSP)

Sep 13th 2026, 8:00AM CDT - Oct 15th 2026, 2:00PM CDT

Table of Contents

Contents Page #

Project Details 5

1. Solicitation Instructions 7

1.1. Bid Instructions and Information 7

1.2. Award Information 7

1.3. Evaluation Criteria 8

1.4. Best Value Incentives 8

1.5. Discussions/Negotiations 8

1.6. E-Bid Support 8

1.7. Submission 9

2. Scope of Work 10

2.1. Proposal Requirements Compliance and Exceptions 10

2.2. Pricing 18

2.3. Revised Off-Hours Escalation Matrix 18

2.4. Revised Service Credit Matrix 19

2.5. Balanced Financial Caps & Remedies 20

3. General Requirements 21

3.1. Company Information 21

3.2. Reference Check 22

3.3. Proposal Requirements 22

3.4. FORM 1295 - CERTIFICATE OF INTERESTED PARTIES 24

3.5. REPRESENTATION AND CERTIFICATION 25

3.6. NOTIFICATION OF CRIMINAL HISTORY 25

3.7. CRIMINAL BACKGROUND CHECKS/SEARCHES 26

3.8. IDENTIFICATION BADGE(S) 27

3.9. MISCONDUCT BY CONTRACTING PARTY/SERVICE PROVIDERS 27

3.10. CONFLICT OF INTEREST 28

3.11. INSURANCE AND/OR BONDS 29

3.12. WORKERS COMPENSATION 29

3.13. FIREARM ENTITY OR FIREARM TRADE ASSOCIATION 30

3.14. NO BOYCOTT OF ISRAEL 30

3.15. TRANSACTIONS WITH AN ABORTION PROVIDER OR AFFILIATE 31

3.16. DALLAS INDEPENDENT SCHOOL DISTRICT ANTITRUST

CERTIFICATION STATEMENT (Tex. Government Code 2155.005) 31

3.17. PROHIBITION OF CONTRACTS ENGAGED IN BUSINESS WITH

IRAN, SUDAN, OR FOREIGN TERRORIST ORGANIZATIONS 31

3.18. Prohibition on Diversity, Equity, and Inclusion 32

3.19. INTERLOCAL AGREEMENT ("Rider") CONSENT FORM 32

3.20. CENTRAL TEXAS PURCHASING ALLIANCE (CTPA) 33

3.21. BIDDER, REGISTERED VENDOR AND AWARDED VENDOR 33

3.22. INVOICE REFERENCE NUMBER/INFORMATION 34

3.23. APPLICABILITY TO SUBCONTRACTORS 34

3.24. INFORMATION DEEMED PUBLIC RECORDS 34

3.25. SBO 36

4. Federal Requirements (EDGAR) 37

4.1. (A) 37

4.2. (B) 37

4.3. (C) 38

4.4. (D) 38

4.5. (E) 39

4.6. (F) 39

4.7. (G) 40

4.8. (H) 40

4.9. (I) 41

4.10. (J) 41

4.11. (K) 42

4.12. RECORD RETENTION REQUIREMENTS FOR CONTRACTS

INVOLVING FEDERAL FUNDS 42

4.13. CERTIFICATION OF COMPLIANCE WITH EPA REGULATIONS

APPLICABLE TO GRANTS, SUBGRANTS, COOPERATIVE

AGREEMENTS, AND CONTRACTS IN EXCESS OF $100,000 OF

FEDERAL FUNDS

4.14. CERTIFICATION OF COMPLIANCE WITH THE ENERGY POLICY

AND CONSERVATION ACT 43

4.15. CERTIFICATION OF COMPLIANCE WITH BUY AMERICA

PROVISIONS 43

4.16. CERTIFICATION OF NON-COLLUSION STATEMENT 43

4.17. CERTIFICATION OF ACCESS TO RECORDS - 2 C.F.R. 200.337 44

4.18. CERTIFICATION OF COMPLIANCE WITH NEVER CONTRACT

WITH THE ENEMY - 2 C.F.R. 200.215 44

4.19. PROHIBITION ON CERTAIN TELECOMMUNICATIONS AND VIDEO

SURVEILLANCE SERVICES OR EQUIPMENT - 2 C.F.R 200.216 44

4.20. AGREEMENT TO COMPLY 45

4.21. INTANGIBLE PROPERTY 45

4.22. PROFIT AS A SEPARATE ELEMENT 46

Project Details

Project Managed Security Services Provider (MSSP)

Ref. # JV-250412

Type RFP

Description This Request for Proposal (RFP) will be used to purchase managed security services to provide off-hours primary coverage, platform tuning, and operational support for Dallas ISD EdTech's strategic security stack.

This is for District-wide use, on an "as needed" basis.

All vendors are encouraged to participate even if vendors are the sole source providers.

This proposal is being issued in accordance with Title 2 of the Code of Federal Regulations (2CFR) Part 200 requirements to procure vendors who provide goods or services purchased by Dallas ISD using federal dollars. This proposal may be used with local, state, federal, and grant-funded programs.

LENGTH OF CONTRACTThe term of this proposal shall be for a three (3) year agreement with two (2) successive one

(1) year extensions based on the long-range needs of the District and mutual consent of both parties not to exceed five (5) years total. Any contract that results from this solicitation and upon Mutual Agreement of the awarded vendor and the District, may be extended not to exceed a total of 5 years(s). If either party intends not to renew the Contract, that party must give written notice to the other party no fewer than ninety (90) days prior to the expiration of the then-current term of the Contract. If the District fails to timely exercise any of the options to renew, all remaining options to renew shall expire and terminate.

Open Date Sep 13th 2026, 8:00AM CDT

Questions Due Date Sep 30th 2026, 12:00PM CDT

Close Date Oct 15th 2026, 2:00PM CDT

Pre-proposal Meeting Link https://teams.microsoft.com/meet/275627267036409?

p=Omeg96OmcYcM2tw3W2

Events

Event Name

Duration Description

Open Date Sep 13th 2026, 8:00AM

CDT

Posting date for the Opportunity

Pre- Proposal Meeting

Sep 28th 2026, 2:30PM

CDT

A pre-proposal meeting will be held at 2:30 PM CST via TEAMS video conference on Monday, September 28, 2026.

Please submit questions regarding this RFP through the vendor discussions section of this RFP. Only questions received through the portal will be considered. It is highly encouraged that all potential proposers participate and attend the pre-proposal.https://teams.microsoft.com/meet/ 275627267036409?p=Omeg96OmcYcM2tw3W2

Questions Due Date

Sep 30th 2026, 12:00PM

CDT

Deadline to submit Questions

Close Date

Oct 15th 2026, 2:00PM

CDT

Deadline for Submissions

1. Solicitation Instructions

1.1 Bid Instructions and Information

The District prefers submissions to be completed electronically via the Bonfire portal. Vendors must register at https://dallasisd.bonfirehub.com to access the portal, which supports Microsoft Edge, Google Chrome, and Mozilla Firefox with JavaScript and cookies enabled. For technical assistance, vendors may visit Bonfire’s help forum at https://procurement-help.eunasolutions.com/hc/en-us, email support.procurement@eunasolutions.com, or call 1-800-354-8010. Submissions must be uploaded, submitted, and finalized before the posted due date. Uploading large files may take time, depending on the size and Internet speed, so it is strongly recommended that vendors allow at least one business day to complete the process.

Although we are legally required to accept paper bids, we strongly request that bidders submit this bid electronically. Please feel free to call us if you require any assistance with this submittal. Electronic bidding will eliminate errors, eliminate unnecessary work, and is more friendly to the environment. Manual submissions must be delivered in a sealed envelope by the specified due date and time. Only one format, either electronic or manual, is required. Fax or email submissions will not be accepted. Manual submissions must consist of one original hard copy with a signed copy of the Proposal Acknowledgement located at the end of the instructions and may be sent via mail, FedEx, UPS, or hand delivery to the following address:

Dallas Independent School District

Procurement Services

9400 N Central Expwy, Ste 1510, Attn: [BID NUMBER & NAME]

Dallas, TX 75231 Bids submitted after the published time and date will be considered untimely and will not be considered.

Any requests or questions for additional information pertaining to the bid specifications shall be submitted through the electronic bid system. Requests or questions must be submitted by dates indicated on timeline in bid document.

Contact between responders or potential responders and the District user departments during the bid request process or evaluation period is prohibited. Any attempt by a responder or potential responder to contact the department will result in disqualification. All communications shall be performed by the District Procurement Services personnel during the bid process.

All addenda will be issued via the electronic bid system. It is the vendor's responsibility to obtain any addenda that pertain to a particular bid. Please check regularly for any posted addenda.

The District is exempt from Federal Excise Tax, and State Tax. Do not include tax in your bid totals. Tax exemption certificate can be furnished upon request.

If a bidder requests to withdraw a bid/proposal and the District allows the withdrawal of the bid/proposal, the bidder may resubmit the bid/proposal, or submit a new bid/proposal, up until the advertised due date and time. All bids/proposals in the possession of the District at the due date and time shall be deemed final, conclusive, and irrevocable, and no proposal shall be subject to withdrawal, amendment, or correction after the due date and time for submission.

1.2 Award Information

Each Offer will be analyzed and evaluated by a panel selected by the District.

The District intends to award a contract to one or more responsive, responsible Offerors that provide the best value to the District.

Pursuant to District Board policy and applicable law, "best value" is determined according to the price and non-price criteria in the Evaluation and weighted at the sole discretion of the District.

By submitting an Offer, an Offeror acknowledges the District's right to establish scoring criteria that comply with applicable law as well as the District's bid protest procedures outlined in the District’s General Terms and Conditions.

Even when an award to a single Offeror is envisioned, the District reserves the right, in its sole discretion, to make awards to multiple Offerors (or to make no award at all).

Non-responsive or disqualified Offers will be not eligible for award consideration. Reasons for being deemed non-responsive or being disqualified include but are not limited to not meeting requirements of the proposal, receipt of Offer after date/time posted; failure to sign the Offer; failure to include one or more Conditions of Service/Term Agreement.

The District reserves the right to reject any use of Offeror's terms and conditions of any kind, including web links to any online terms and conditions, or requiring the use of Offeror's form of agreement.

https://dallasisd.bonfirehub.com https://dallasisd.bonfirehub.com https://procurement-help.eunasolutions.com/hc/en-us https://procurement-help.eunasolutions.com/hc/en-us mailto:support.procurement@eunasolutions.com

1.3 Evaluation Criteria

In addition to the evaluation criteria noted in the General Terms and Conditions, as part of "any other relevant factors" the District will use the following criteria in the evaluation. Final evaluations of this proposal will be based on the

Texas Educational Code 44.031(b). Dallas ISD will not award bids based on low price alone. Criteria and points will be used in weighting which proposal(s) offer the best overall product, service, and references for the intended purpose.

Purchase Price Reputation of the vendor and vendor's goods or services Quality of the vendor's goods or services Extent to which the goods or services meet the district's needs Vendor's past relationship with the district The impact on the ability of the District to comply with laws and rules relating to SBE. This will be applied to your SBE Participation and is assessed as follows:

Offeror demonstrated a commitment to the district's SBE program by providing enhancements to the administration of the proposer's contracting process for the work to be done by SBE firms. Examples of this commitment may include any of the following: expedited payments, Mentor-Protege Programs, early release of retainage, expanding the pool of diverse subcontractors to firms that have not done business with the district, etc.

Offeror submitted a list of two (2) SBE subcontractor references.

Offeror is a certified SBE OR Offeror submitted a Joint Venture Agreement with a certified SBE OR Offeror submitted a Prime Subcontractor Teaming Agreement with a certified SBE.

Offeror submitted a diverse list of certified SBE subcontractors, sub-consultants, or suppliers that meets or exceeds the district's SBE aspirational goal in meaningful roles OR Offeror demonstrated outreach designed to meet the SBE project goals with a diverse SBE team of subcontractors, suppliers, and sub-consultants.

Offeror demonstrated a comprehensive framework and understanding of the district's SBE program by providing a written and detailed SBE compliance plan, designating a high ranking individual who will be responsible for SBE contract compliance, monitoring, and reporting, ensuring no unauthorized changes to SBE subcontractors, adhering to the SBE commitment and subcontractor payment terms, executing the SBE subcontracting schedule, complying with the district's SBE Program guidelines, etc.

Total long-term cost to the district Principal place of business or number of employees in the State Other relevant factors specifically listed in this proposal

1.4 Best Value Incentives

Consideration will be given to Offerors who include best value incentives or value-adds at no additional cost to the

District. To be considered, these incentives/value-adds must be clearly disclosed.

1.5 Discussions/Negotiations

During the evaluation of certain Offers, the District may hold discussions/negotiations with Offerors that are in the competitive range to provide the goods and/or services described in this solicitation. Discussions will NOT be conducted for Competitive Sealed Proposals. Discussions may be conducted for responses to Requests for Proposals or Requests for Qualifications; however, the District reserves the right to award (or not award) a Contract without conducting any discussions; therefore, Offerors are encouraged to provide their best Offer initially and not anticipate the opportunity to make a better offer later.

If conducted, discussions will be held at a place, time, and date as determined by the District. All associated costs incurred by an Offeror in connection with the discussions will be at Offeror's own expense. Additionally, a selected Offeror(s) may be required to attend one or more Board Briefings and/or Board Meetings to address questions about the Offer and any resulting Contract. Such attendance shall be at no additional cost to the District.

1.6 E-Bid Support

For technical assistance, vendors may visit Bonfire’s help forum at https://procurement-help.eunasolutions.com/hc/en-us, email support.procurement@eunasolutions.com, or call 1-800-354-8010.

1.

2.

3.

4.

5.

6.

A.

B.

C.

D.

E.

8.

9.

10.

https://procurement-help.eunasolutions.com/hc/en-us https://procurement-help.eunasolutions.com/hc/en-us https://procurement-help.eunasolutions.com/hc/en-us https://procurement-help.eunasolutions.com/hc/en-us

The District provides a workstation for vendors who do not have access to a computer. Please call Procurement

Services at 972-925-4100 to schedule an appointment to access the computer. Vendor should preview the bid requirements and come with prepared documents to upload into the system.

1.7 Submission

It is recommended that once you have completed your final submission and received a notice status of “Submission

Complete” from Bonfire, you access your account again and review the documents to verify that the correct content has provided. Once the close date has passed, you will not have an opportunity to change any of the submitted documents.

All bids/proposals must be SUCCESSFULLY submitted before the due date and time regardless of your organization's ability to submit bids online. It is the supplier's sole responsibility to ensure that bid/proposal documents successfully arrive before the due date and time. The District's online bidding application utilizes the

Internet and the World Wide Web, which is comprised of systems that are completely out of the District's control. It is highly recommended that the suppliers allow themselves enough time to complete a successful submission. Do not wait until the last minute.

1.7.1 Proposal Acknowledgement - Do you affirm that you have red, understand and agree to the requirements of the specifications and all other provisions of this solicitation. [Requir ed] [Single Choice]

(Yes) / (No)

2. Scope of Work

The Dallas Independent School District is seeking offers for a managed security service partner to support and enhance our security operations program. This partner should have demonstrated expertise and experience in building and managing programs utilizing our strategic technology stack. The partner will be expected to provide weekend, overnight, and holiday primary coverage of the technology, with defined escalation paths and situations to

Dallas ISD EdTech leadership. The partner will also be expected to assist with tuning, enhancing, and fixing alerts, automations, and core data sources to ensure the district remains as well protected as possible from cyber threat actors.

2.1 Proposal Requirements Compliance and Exceptions

2.1.1 Proposal Requirements Compliance and Exceptions (Q-98PQ) [Required] [Questionnaire]

Quality of Vendor's Goods and/or Services

Quality of Vendor's Goods and/or Services

Question: Firm/vendor has provided managed services at an education institution with experience supporting Palo Alto products in one of the top twenty-five (25) K-12 educational institutions in North America.

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

Question: Firm/vendor has a proven successful history of providing similar services in institutions of at least 25,000 employees or more.

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

Question: Firm or controlling partners, under the current name or another name, has not been involved in any lawsuits or judgements in the last 5 business years.

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

Question: Firm/vendor has successfully achieved MSSP Advanced Specialization on Palo Alto products, including: - Cortex XSIAM - Next-Gen Firewall

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

Question: Firm/vendor must ensure that Dallas Independent School District retains ownership of all data captured in the tenant. If the firm/vendor sells or transfers their business, Dallas ISD school officials should have the option to terminate the contract, without any cost. In the event the vendor closes their business, all Dallas ISD data must be returned electronically using an equivalent electronic system.

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

Extent to which Vendor’s Goods/Services meet the district’s needs

Minimum Vendor Requirements

Question: Security & Data Sharing Policies: Firm/vendor maintains and provides documentation of their security measures and incident response procedures in the event of a data breach or security lapse.

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

Question: Security & Data Sharing Policies: Right to Audit: Vendor agrees that the District has the right to periodically audit vendor’s IT infrastructure, privacy policies, and cybersecurity practices applicable to the District to ensure ongoing compliance with contractual obligations and das security standards. NOTE: District must provide in writing at least thirty (30) days in advance of the proposed data of cush an audit. Any such audit may not exceed three (3) days and may not occur more than once in a 12-month period.

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] /

Question: Security & Data Sharing Policies: Vendor agrees to execute a Data Protection Agreement (DPA) that holds the vendor accountable for any unauthorized data access or breaches, with clear financial or legal penalties for non-compliance. NOTE: Firm/vendor is requested to use the District’s DPA template.

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

Question: Training/Support: Vendor commits to ensuring their security analysts regularly attend training to become subject matter experts in the Palo Alto stack of products.

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

Question: Security: Firm/vendor ensures that data within their environment is secure and compliant with federal, state, local policies, and regulations.

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

Question: Security: Vendor utilizes a SIEM (Security Information Event Management) or similar system to monitor internal environment for any security incidents or data breaches.

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

Question: Security: Vendor utilizes Distributed Denial of Service (DDoS) prevention and mitigation technologies.

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] /

Question: Security: Vendor uses Web Application Firewalls (WAF) to protect any web interfaces from common threats.

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

Question: Security: Vendor implements automated monitoring and incident response protocols to detect and address any potential security breaches or threats to the application in real-time.

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

Dedicated Off-Hours, Weekend, and Holiday Monitoring

Question: Explicit Coverage Windows: The Vendor must provide active, live "eyes-on-glass" monitoring, triage, and analysis strictly during the District’s off-hours: Monday through Friday from 5:00 PM to 7:00 AM (Local Time), 24 hours a day on weekends, and 24 hours a day on all District-observed holidays and seasonal breaks.

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

Question: District SIEM Utilization: The Vendor will not deploy a proprietary SIEM platform.

Instead, the Vendor’s SOC analysts must directly log into, monitor, and manage alerts within the District’s existing SIEM.

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] /

Question: Education Sector Threat Contextualization: Vendor analysts must possess the specific expertise required to differentiate between standard student behavioral anomalies (e.g., attempts to bypass web filters or unauthorized VPN usage) and true malicious activity or lateral threat movement..

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

Operational Integration with the District’s K-12 Stack

Question: Tool Proficiency: The Vendor must demonstrate deep technical proficiency and operational experience with the District's specific SIEM and integrated security stack (e.g., specific EDR tools, firewalls, and cloud suites).

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

Question: EdTech Cloud Suite & Multi-OS Context: Vendor Analysts must actively monitor alerts routed to the SIEM from the District's core educational environments, including Google Workspace for Education and/or Microsoft 365 Education, as well as a mixed device fleet comprising ChromeOS (Chromebooks), Windows, macOS, and iOS.

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

Question: Identity Provider Awareness: The Vendor must be capable of analyzing and responding to anomalous authentication alerts within the District’s Identity and Access Management (IAM) and Single Sign-On (SSO) systems integrated with the SIEM.

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

Incident Response, Containment, and Tool-Specific Playbooks

Question: Remote Off-Hours Containment: Vendor analysts must be capable of executing remote containment actions directly through the District’s existing security tools (e.g., isolating a host via the District’s EDR or disabling an account in the District's Identity Provider) during off-hours based on pre-approved playbooks.

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

Question: Customized Escalation Pathways: The Vendor must adhere to a strict off-hours escalation process, reserving phone/SMS alerts for validated, high-fidelity critical threats while queuing low-to-medium alerts for the District’s morning shift.

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

Question: Post-Incident Documentation: For any critical incident triaged during off-hours, the Vendor must document all findings, timeline of events, and analyst actions directly within the District’s ticketing system or SIEM by 7:00 AM the following business day.

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

Question: Tabletop Exercises: The Vendor must participate in at least two (2) annual, co-managed cybersecurity tabletop exercises alongside District IT staff at no additional cost.

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

Secure Access and Student Data Privacy

Question: Secure Remote Access: The Vendor’s analysts must access the District's SIEM via secure, multi-factor authenticated (MFA), and fully auditable connections.

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

Question: Data Zero-Exfiltration: Because the District owns the SIEM, no District log data, student data, or personnel data shall be duplicated, transferred, or stored within the Vendor’s own internal networks or ticketing systems, unless explicitly approved for brief incident reporting.

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

Question: Regulatory Compliance: The Vendor’s operational workflows must strictly align with federal and state student privacy laws, including FERPA and COPPA. The Vendor must agree to sign the District's Data Sharing Agreement (DSA)

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

Question: Personnel Changes: The Vendor must notify the District’s IT leadership in writing within four (4) hours of any personnel change involving an analyst, engineer, or manager who possesses active credentials to the District’s SIEM or identity environment. If a vendor employee is terminated for cause, notification must be immediate.

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

Co-Managed Operations and Shift Handovers

Question: Seamless Handoff Workflows: The Vendor must detail their process for daily operational handoffs. This includes how the Vendor reviews lingering items left by District staff at 5:00 PM, and how the Vendor summarizes overnight activity for District staff arriving at 7:00 AM.

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

Question: Unobstructed Shared Workspace: Both District IT staff and Vendor analysts must work out of the same SIEM workspace, ensuring full, concurrent visibility into alert histories and analyst notes.

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

Question: Audit Trail of Analyst Actions: All actions taken by Vendor analysts within the District's SIEM (e.g., closing an alert, changing severity, adding notes) must be cleanly tied to individual vendor analyst accounts for transparent auditing.

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

Question: Intellectual Property of SIEM Enhancements: Any custom detection rules, log parsers, dashboards, reports, or SOAR automation playbooks created, modified, or developed by the Vendor within the District’s SIEM during the contract term shall become the sole intellectual property of the District. The Vendor shall not delete, lock, or obscure these configurations upon contract termination or expiration.

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

Service-Based Pricing Model (No Platform Fees)

Question: Pure Service Cost Structure: Because the District provides the underlying SIEM software licensing, the Vendor’s pricing model must be based purely on the delivery of monitoring services, analyst hours, or log volume ingestion, rather than per-seat or per-endpoint software licensing fees.

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

Question: Service Level Agreement (SLA) Financial Credit Framework: The Vendor shall comply with the Target SLAs set forth in the Operations Framework. If the Vendor fails to meet the Target SLAs, DISD may, in its sole discretion, assess service fee credits. The amount, applicability, and calculation of any service fee credits shall be determined in accordance with a financial credit matrix approved by DISD. Repeated failures to achieve the Target SLAs, as determined by DISD, will constitute grounds for termination for cause.

Answer options: (Exceeds Comply) / (Comply) / (Partially Comply) / (Comply by Exception) / (Does Not Comply)

Comment: [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input] / [Required Vendor Input]

2.1.2 Supplemental Pages for Proposal Requirements Compliance and Exceptions [Optional] [PDF]

(Vendor file uploads)

2.2 Pricing

2.2.1 Total annual cost of a managed security services offering for holiday, weekend, and overnight coverage [Required] [Currency]

(Vendor currency input)

2.3 Revised Off-Hours Escalation Matrix

The following matrix defines how the Vendor’s SOC analysts are expected to categorize alerts within the District's

SIEM and engage District personnel outside of standard business hours (5:00 PM to 7:00 AM Local Time, Weekends, and Holidays).

Severity Level K-12 Context / Technical Definition

Critical Active ransomware propagation; compromise of

Domain Controller/Identity provider; unauthorized access to Student Information System (SIS).

High Multiple endpoints showing active malware; brute-force attacks on administrative cloud accounts;

suspicious lateral movement; denial of service (DOS).

Medium Isolated malware detection on a student device

(successfully blocked by EDR); minor policy violations; suspicious external scanning.

Low Routine adware; authorized staff testing VPNs;

standard system noise or false positives.

Vendor Action in District Stack Vendor Notification Action Target SLA

Execute pre-authorized containment in District EDR/

Identity tool immediately.

Immediate Voice Call to primary emergency contact until confirmation is received.

< 30 mins

Isolate affected endpoints via

District EDR; restrict compromised user accounts.

SMS Alert + Email to on-call technical rotation.

< 60 mins

Log notes in District SIEM/ticket, queue for District review.

Email Summary queued for next-business-day review by 9:00 AM.

Next Business Day

Suppress or resolve per District playbooks; log for trends.

Logged in District SIEM only. N/A

2.4 Revised Service Credit Matrix

Service Credits will be calculated monthly and applied as a financial credit against the District's Monthly Service Fee

(MSF) for the affected billing cycle. Delays caused by District infrastructure outages, vendor holiday staffing pre-approved by the District, or third-party carrier failures will be excluded from calculation tracking.

Event Severity Level Target SLA Breach Threshold

Critical < 30 minutes Initial voice call notification > 30 minutes from SIEM alert generation

High < 60 minutes SMS/Email notification > 60 minutes from

SIEM alert generation

Medium Next Business Day Summary email not delivered by 7:30 AM

Local Time

Service Credit (% of MSF)

2.5% per occurrence

1.0% per occurrence

0.5% per occurrence

2.5 Balanced Financial Caps & Remedies

Reduced Monthly Aggregate Cap: The total cumulative Service Credits applied to any single billing month shall not exceed 7.5% of the total Monthly Service Fee (MSF).

Cure Period for Single Misses: A single missed SLA within a calendar month will be treated as an operational anomaly and billed at the standard rate minus the individual credit percentage.

Chronic Operational Failure Threshold: The District retains the right to terminate the contract for cause without early termination penalties only if the Vendor exhibits a pattern of chronic failure, defined strictly as:

Missing the Critical alert SLA (30 minutes) four (4) or more times in a single calendar month.

Reaching the maximum 7.5% Service Credit cap in two (2) consecutive months or three (3) times within a 12-month rolling window.

3. General Requirements

3.1 Company Information

Attachments (Documentation): W-9_Blank_Template.pdf

3.1.1 Name of the firm making the offer: (W-9 name and dba if applicable) [Required] [Text]

(Vendor text input)

3.1.2 Company Federal Tax ID Number [Required] [Text]

(Vendor text input)

3.1.3 Company Address, City , State, Zip [Required] [Text]

(Vendor text input)

3.1.4 Local Telephone Number or Toll-Free Number [Required] [Text]

(Vendor text input)

3.1.5 Number of Personnel (non-clerical) employed [Required] [Text]

(Vendor text input)

3.1.6 Number of Personnel (clerical) employed [Required] [Text]

(Vendor text input)

3.1.7 Contact Representative Name [Required] [Text]

3.1.8 Contact Representative Address (if different from Company) City, State, Zip [Require d] [Text]

(Vendor text input)

3.1.9 Contact Representative Direct Telephone Number [Required] [Text]

(Vendor text input)

3.1.10 Contact Representative Email Address [Required] [Text]

(Vendor text input)

3.1.11 W-9 Form [Required] [PDF]

(Vendor file upload)

3.2 Reference Check

To ensure your proposal for JV-250412 Managed Security Services Provider (MSSP) is complete, please fill in your company's information and your references details on the attached Reference Check form. Once done, forward the form to three designated references. They must complete the questionnaire section and email the finished form directly to Procurementreferencecheck@dallasisd.org from their company's email account. The strict deadline for their submission is Oct 15 2026, 02:00 PM CDT.

Attachments (Documentation): JV-250412_Reference_Check_Form.pdf

3.3 Proposal Requirements

Attachments (Documentation): DISD_TsCs_Deviation_Request_1.13.2026.xlsx, SPEC_or_SOW_Deviation_Request_1.13.2026.xlsx, mailto:Procurementreferencecheck@dallasisd.org mailto:Procurementreferencecheck@dallasisd.org

DISD_Vendor_Internal_Catalog_Pricing_Template.xlsx, Standard_General_Terms_and_Conditions_Oct_2024.pdf

3.3.1 In submitting this proposal, the submitter certifies they are a duly authorized representative of the Offeror offers to provide the goods and/or services described in this solicitation document according to the terms contained in the Offer.Offerors are required to fully disclose any “hidden" or “additional" fees, costs, and expenses that are not reflected.

The District will not be liable for hidden or additional fees, costs, and expenses that are not disclosed. [Required] [Single Choice - Dropdown]

(Yes - I agree and understand) / (No - I do not agree and understand this response may result in our proposal being deemed nonresponsive.)

3.3.2 Please note that all official communications regarding this solicitation will be conducted exclusively through the District's electronic bidding system, Bonfire, up to the point of contract award. It is the vendor's sole responsibility to ensure that the contact assigned to submit the bid in Bonfire is also designated to receive all official communications through the system. Any failure to respond in a timely manner to communications sent via Bonfire will be the vendor's responsibility. [Required] [Single Choice - Dropdown]

(Yes - I agree and understand) / (No - I do not agree and understand this response may result in our proposal being deemed nonresponsive)

3.3.3 The offeror agrees to the General Terms and Conditions and any Special Terms and Conditions (if applicable) of this solicitation and in case of conflict with other documents provided by the Offeror, these General and/or Special Terms and Conditions take precedence and prevail unless Offeror specifically requests a variance and the District agree to such changes in writing. Vendors shall formally request deviation to DISD Standard Terms & Conditions using DISD Standard Terms & Conditions Formal Deviation Request Form. General Terms and Conditions are posted on the Dallas ISD website at https://www.dallasisd.org/departments/procurement/doing-businesswith-dallas-isd. [Requir ed] [Single Choice - Dropdown]

(Yes - I agree and understand) / (No - I do not agree and this response may be the basis for non-award and/or cancellation and/or termination of any award)

3.3.4 Formal request for deviation to DISD Standard Terms & Conditions (Using DISD Standard Terms & Conditions Formal Deviation Request Form) [Optional] [Any]

(Vendor file upload)

3.3.5 Does the offeror have deviations to the bid specifications and/or Statement of Work?

The District reserves the discretion to determine whether the proposed deviations render the Offer nonresponsive. The District reserves the right to reject any use of the Offeror’s terms and conditions of any kind, including web links to any online terms and conditions, or use of the Offeror’s form of agreement.If the Offeror has any exceptions or deviations to the solicitation documents, bid specifications, or Statement of Work, they must be identified in the designated section of the RFP questionnaire. [Required] [Single Choice - Dropdown]

(NO deviations or exceptions to the solicitations's Scope of Work/Specifications) / (Y ES we have included our exceptions/deviations AND acknowledges the District may view the Offer as nonresponsive.)

3.3.6 Offerors commits to a firm, fixed-price contract for the initial term. Vendor shall price based on any increase that may occur in the initial term. Price adjustments at the renewal will need to be agreed upon by all parties. Awarded vendor(s) shall submit in writing, no later than one hundred twenty (120) days prior to the anniversary of the effective date, any changes in pricing. All fees, costs, and expenses required for Offeror to provide the goods and/or services (including, but not limited to, contractor staff costs, travel expenses, overhead, hardware/software costs, connecting devices costs, and software customization costs), must be included in the firm fixed price. Details of the fees, costs, and expenses must be disclosed in writing. [Required] [Single Choice - Dropdown]

(Yes - I agree) / (No - I do not agree and understand this response may result in our proposal being deemed nonresponsive.)

3.4 FORM 1295 - CERTIFICATE OF INTERESTED PARTIES

Pursuant to HB 1295 (2015), the addition of section 2252.908 of the Government Code, all awarded vendors must fill out electronically the Texas Ethics Commission's online filing application https://www.ethics.state.tx.us/whatsnew/ elf_info_form1295.htm. The law states that a governmental entity or state may not enter into certain contracts with a business entity unless the business entity submits a disclosure of interested parties (Form 1295) to the governmental entity or state agency at the time the business entity submits the signed contract to the governmental entity or state agency. The Texas Ethics Commission has adopted rules requiring the business to file Form 1295 electronically with the Commission. This form must then be signed and attached to the Response Attachments, prior to any business transaction. If your company is publicly traded you do not need to complete this form.

Attachments (Documentation): DISD_Certificate_of_Interested_Parties_- _Form_1295_Guidance.pdf https://www.ethics.state.tx.us/whatsnew/elf_info_form1295.htm https://www.ethics.state.tx.us/whatsnew/elf_info_form1295.htm https://www.ethics.state.tx.us/whatsnew/elf_info_form1295.htm https://www.ethics.state.tx.us/whatsnew/elf_info_form1295.htm

3.4.1 Do you acknowledge and agree to comply with these filing requirements?

[Required] [Single Choice - Dropdown]

(Yes - I agree and am compliant with Certificate of Interested Parties requirements) / (No - I do not agree and understand this response may result in our proposal being deemed nonresponsive)

3.4.2 FORM 1295 - CERTIFICATE OF INTERESTED PARTIES - Pursuant HB 1295 (2015), the addition of section 2252.908 of the Government Code, all awarded vendors must fill out electronically, with the Texas Ethics Commission's online filing application.

[Required] [PDF]

(Vendor file upload)

3.5 REPRESENTATION AND CERTIFICATION

The Offeror certifies they are authorized to bind the company to this submission and confirms that the company has no outstanding debts to the District. Please note that any undisclosed indebtedness to the District may result in the disqualification of this proposal or the immediate termination of any subsequent award.

3.5.1 Please select the statement that applies to your organization: [Required] [Single Choice - Dropdown]

(I affirm representation as an authorized company representative and certify we are not indebted to the district) / (No - I do not represent nor certify and understand this response may result in our proposal being deemed nonresponsive)

3.6 NOTIFICATION OF CRIMINAL HISTORY

All vendors doing business or desiring to do business with the district must provide a notification of criminal history as required under Texas Education Code, Chapter 44, Subsection B, Section 44.034.

Texas Education Code, Chapter 44, Subchapter B, Section 44.034, Notification of Criminal History, reads as follows:

(a) A person or business entity that enters into a contract with a school district must give advance notice to the district if the person or an owner or operator of the business entity has been convicted of a felony. The notice must include a general description of the conduct resulting in the conviction of a felony.

(b) A school district may terminate a contract with a person or business entity if the district determines that the person or business entity failed to give notice as required by Subsection (a) or misrepresented the conduct resulting in the conviction. The district must compensate the person or business entity for services performed before the termination of the contract.

(c) This section does not apply to a publicly held corporation.

Added by Acts 1995, 74th Leg., ch. 260, Sec. 1, eff. May 30, 1995.

3.6.1 Please select the statement below that accurately reflects your firm's status. If "Applicable" is selected, you must provide the name of the individual and a general description of the conduct in the text field provided. [Required] [Single Choice - Dropdown]

(My firm is a publicly held corporation therefore this reporting requirement is not applicable) / (My firm is not owned nor operated by anyone who has been convicted of a felony) / (Applicable - name of felon and details of the conviction(s))

3.6.2 If 'Applicable' was selected above, provide the name(s) and conviction details here. [ Optional] [Text]

(Vendor text input)

3.7 CRIMINAL BACKGROUND CHECKS/SEARCHES

Texas Education Code (TEC) 22.0834 and 22.08341 states that a contractor that provides services to a school district or charter school must be fingerprinted before beginning work, if the contractor

1) will have continuing duties related to the contracted services, and

2) will have the opportunity for direct contact with students. Additionally, the law requires that a contractor certified to a school district or charter school that it has received all criminal history information for its employees who provide services for the school. Pursuant to 22.08341(c), the requirement does not apply to a contractor that performs construction, alteration, or repair of an instructional facility if the Contractor uses separate sanitary facilities, installs a barrier fence, and has a policy that employees may not interact with students or enter areas used by students.

Schools may fingerprint a contractor and/or Contractor’s employees using the Local Education Entity (LEE) Fast

Pass option. The Contractor shall agree to have individuals printed with the LEE pass, and also create subscriptions in the DPS FACT Clearinghouse under the authority of TGC 411.097/Public Law 92-544. The Contractor, however, will not be able to view the results through the DPS Clearinghouse. The Contractor shall bear the burden and cost of the Contractor obtaining a national, fingerprint-based criminal history check. A contractor or subcontractor may not work on District property or any location the District deems a place where students are regularly present when:

They have been convicted of a felony or misdemeanor involving moral turpitude, as defined by Texas law.

They have charges pending, they have been convicted, received probation, or deferred adjudication of any of the following:

1. Any offense against a child

2. Any sex offense

3. Any felony offense involving controlled substances

4. Any felony offense against property

5. Any other offense the District, in its sole discretion, believes might compromise the safety of student, staff, property, or reputation of the District by the employment of the Contractor.

A vendor’s violation of this section shall constitute substantial failure.

A.

B.

3.7.1 Do you acknowledge and agree to comply with these criminal history and fingerprinting requirements? [Required] [Single Choice - Dropdown]

(Yes - I agree and understand) / (No - I do not agree and this response may be the basis for non-award and/or cancellation and/or termination of any award)

3.8…