download.xlsx

This requirements document is for a managed cybersecurity services solicitation issued by the University of Southern Mississippi, a state institution in Mississippi. The university is seeking enterprise-grade managed cybersecurity services focused on threat prevention, detection, investigation, and response. The vendor must deliver a managed service solution capable of supporting a large higher education environment with extensive users, endpoints, and servers. The services must include 24/7/365 security operations center (SOC) staffing with human-led investigation and response capabilities, not solely automated alerting. Key functional areas include identity and access security with multi-factor authentication and conditional access controls; email and collaboration security with protection against malware, spam, and phishing; endpoint detection and response for workstations and managed devices; server and cloud workload security with vulnerability assessment and threat detection; and centralized security information and event management (SIEM) with log collection and correlation. The vendor must also provide initial cybersecurity assessment services, penetration testing, incident response coordination with university personnel, and structured onboarding and implementation support. The sealed bid submission deadline is Monday, March 9, 2026, at 2:00 p.m. to be received at the Office of the Director of Procurement Services at The University of Southern Mississippi in Hattiesburg.

Vendor qualification requirements mandate that bidders demonstrate experience delivering managed cybersecurity services in enterprise environments with minimum three customer references from implementations within the last 12 months, preferably from higher education institutions. All bidders must be Microsoft-aligned Managed Security Services Providers (MSSP) with verified partnership status demonstrated through membership in the Microsoft Intelligent Security Association (MISA), Microsoft Security Partner Designation, Microsoft verified managed detection and response (MDR/MXDR) partner status, or documented Microsoft security specializations. The vendor must maintain documented disaster recovery and business continuity plans, provide incident notification for confirmed high-severity incidents within 72 hours of discovery, maintain protected audit logs of administrative access and configuration changes, and acknowledge that all university security data remains the property of the university and must be returned in non-proprietary format upon contract termination. Optional enhancements include solution scalability to accommodate infrastructure growth, advanced Microsoft security specializations in security operations and threat detection, identity risk scoring with automated remediation, email policy tuning to reduce false positives, endpoint remediation automation, server security configuration recommendations, proactive threat hunting, real-time incident response collaboration, custom detection logic, and post-incident reporting capabilities.