Managed_Detection_and_Response_(MDR)_Services_[P-67709].pdf

REQUEST FOR PROPOSALS

MANAGED DETECTION AND RESPONSE (MDR)

SERVICES [P-67709]

FOR THE

INFORMATION TECHNOLOGY DEPARTMENT

CITY OF PASADENA, CALIFORNIA

Request for Proposals - Managed Detection and Response (MDR) Services [P-67709] Release Date: Thursday, November 6, 2025

Attachments:

A - SAMPLE CITY MASTER SERVICES AGREEMENT

B - Insurance Requirements D - REQUIRED FORMS - AAs - SIG-LEGAL-STATUS - DECLARATION OF NONCOLUSION 08022024 v2

E - DISQUALIFICATION_DISCLOSURE (4)

F - CONFLICT_OF_INTEREST (5)

G - Pasadena_Taxpayer_Protection_Amendment_Disclosure (2) H - Additional Costs Form

I - DESIGNATED REPRESENTATIVES

M - Relevant Experience Form

1. Introduction

Notice of Federal Funding

This procurement is funded in whole or in part by the U.S. Department of Homeland Security through the State and Local Cybersecurity Grant Program (SLCGP). All applicable federal procurement standards under 2 CFR Part 200 and State of California requirements apply.

By submitting a proposal, the respondent acknowledges that this project is federally funded and that the procurement process is subject to applicable federal and state grant requirements.

1. Summary

Using the City's Microsoft 365 tenant the selected vendor shall establish a tenant-resident 24x7x365 Managed Detection and Response (MDR) service while providing full operational control of the SOC function.

The vendor shall manage all detection, response, and tuning activities within the City's tenant.

The vendor shall deliver Tier 1 endpoint detection, containment, and remediation services. The goal is to enable internal teams to focus on higher-tier analysis and strategic initiatives, while also building a sustainable, co-managed environment that remains fully functional and documented within the City's tenant. All telemetry, rules, alerts, playbooks, and configurations for optimal security operations will reside within the tenant to ensure portability and continuity over time.

The initial scope centers on endpoint protection and Microsoft-native telemetry, but the architecture should be designed with future expansion in mind — including integration of identity, network, and infrastructure logs to support broader correlation and detection capabilities.

This RFP anticipates the requirement of additional Microsoft licensing. The vendor's proposal must clearly identify any such requirements as part of the proposal. However, procurement of Microsoft licenses is not included within this solicitation and will be completed through the City's existing Microsoft EA.

2. Contact Information

Deadline for Questions

The deadline to submit questions related to this solicitation is Monday, November 17, 2025, prior to 4:00 pm.

Questions regarding this solicitation should be submitted directly through the City's eProcurement Portal Q&A function. Do not contact any City employee or official regarding this solicitation. Any questions submitted after the date and time specified may not be considered.

Michael Royer IT Security Officer Email: mroyer@cityofpasadena.net Phone: (626) 744-4220 mailto:mroyer@cityofpasadena.net tel:(626)744-4220

Department:

Information Technology Department

3. Timeline

Release Project Date November 6, 2025

Question Submission Deadline November 17, 2025, 4:00pm

Proposal Submission Deadline December 5, 2025, 2:00pm

2. General Instructions

1. NOTICE REGARDING DISCLOSURE OF CONTENTS OF DOCUMENT

All responses to this Request for Proposal (RFP) accepted by the City of Pasadena (City) shall become the exclusive property of the City. At such time as the City Manager recommends a contractor to the City Council, and such recommendation, with any recommended contract appears on the Council agenda, all proposals accepted by the City shall become a matter of public record and shall be regarded as public, with the exception of those elements of each proposal which are defined by the contractor as business or trade secrets and plainly marked as "Trade Secret", "Confidential" or "Proprietary". Each element of a proposal which a contractor desires not to be considered a public record must be clearly marked as set forth above, and any blanket statement (i.e. regarding entire pages, documents or other non-specific designations) shall not be sufficient and shall not bind the City in any way whatsoever. If disclosure is required or permitted under the California Public Records Act or otherwise by law, the City shall not in any way be liable or responsible for the disclosure of any such records or part thereof.

2. Funding Source

This procurement is funded in whole or in part by the U.S. Department of Homeland Security through the State and Local Cybersecurity Grant Program (SLCGP) administered through the California Office of Emergency Services. All applicable federal procurement standards under 2 CFR Part 200 and State of California requirements apply.

By submitting a proposal, the respondent acknowledges that this project is federally funded and that the procurement process is subject to applicable federal and state grant requirements.

3. Electronic Submission and Delivery Instructions

Parties interested in responding are required to submit proposals electronically through the City of Pasadena's eProcurement Portal no later than 2:00 pm on Friday, December 5, 2025. Please upload sufficiently early electronically through the city's eProcurement Portal before the time and day listed in the Notice Inviting Proposals. Proposals must be received in the system prior to the deadline.

The entire proposal must be formatted on standard-size 8½”x11” pages; 12 point font only. The "Technical Proposal," "Additional Data," and "Statement of Qualifications" can be no more than 50 grand total pages.

The Price Proposal must include all costs associated with the Technical Proposal as described in the Price Proposal instructions in the “#Proposer's Submittals/Checklist.”

The Technical Proposal should disclose your technical approach in as much detail as possible, including, but not limited to, the requirements of the technical proposal instructions. Along with all required forms and submittals (See #Attachments, and #Proposer's Submittals/Checklist. No Pricing shall be included in this part.

https://procurement.opengov.com/portal/pasadena https://procurement.opengov.com/portal/pasadena/projects/205236/document?section=1921337 https://procurement.opengov.com/portal/pasadena/projects/205236/document?section=1921345 https://procurement.opengov.com/portal/pasadena/projects/205236/document?section=1921337

Proposals received after the Proposal Deadline may not be accepted by the City.

4. Technical Proposal

The proposal must be prepared in two parts: a "Technical Proposal" and a "Price Proposal." Each of the parts shall be separate and complete in itself so evaluation of one may be accomplished separate from the evaluation of the other. The Technical Proposal should disclose your technical approach in as much detail as possible, including, but not limited to, the requirements of the technical proposal instructions. Along with all required forms and submittals (See #Attachments, and Submittals/Checklist. No Pricing shall be included in this part.

5. Separate Price Proposal

The Price Proposal must include all costs associated with the Technical Proposal as described in the Price Proposal instructions in the “Submittals/Checklist.”

Parties interested in responding are required to submit their Price Proposal with their Technical proposal through the City's eProcurement Portal.

The pricing must include the total price proposed to accomplish all the performance and deliverables requested in this RFP, and offered by your firm. Each Proposer must submit a Price Proposal containing all costs associated with the technical proposal. The price proposal shall describe both the total and the detailed price for which the consultant will commit to complete the total scope of work and end products. The price proposal detail shall describe costs for each professional’s time, for the completion of each proposed task, and for all materials and supplies.

The fee information is relevant to a determination of whether the fee is fair and reasonable in light of the services to be provided. Costs shall include the proposed costs and, if necessary, the approximate number of hours to provide the services as described in your proposal. Any additional fees outside the scope of the agreement must be approved in writing before commencing services for said fees. Vendor’s RFP response must be inclusive of all costs and expenses associated with travel, lodging, and any other incidental costs. The City will not separately reimburse costs not included in the proposal.

Reference SAMPLE PRICE PROPOSAL.

Reimbursable cost schedules shall depict only those expenditures that are exclusive to and in support of the scope of services. The proposed reimbursable cost schedule shall include a detailed list of reimbursables.

A contract will not be awarded to a consultant without an adequate financial management and accounting system as required by 48 CFR Part 31 and 2 CFR Part 200.

Each Proposer must submit a PRICE Proposal containing all costs associated with the technical proposal. Using the attached Price Proposal in this RFP, provide Proposer’s lump-sum price for performing all services and work called for in the SCOPE OF WORK. The Proposer’s lump-sum price shall include, without limitation:

https://procurement.opengov.com/portal/pasadena/projects/205236/document?section=undefined https://procurement.opengov.com/portal/pasadena/projects/205236/document?section=undefined

• all designs, equipment, materials, labor, insurance and bond premiums, home office, jobsite, and other overhead, profit and services relating to the Proposer’s performance of its obligations under the Contract (including all work, equipment, materials, labor, and services provided by subcontractors and intellectual property rights necessary to perform the work);

performance of each and every portion of the work

• all costs of obtaining Government approvals other than Government approvals that are the responsibility of the City of Pasadena;

• all costs of compliance with Government rules, except to the extent such compliance is the responsibility of the City of Pasadena;

• all taxes, duties, permits, and other fees or royalties incident to the performance of the

SCOPE OF WORK;

payment of all salaries, wages, benefits, and expenses of the Proposer’s employees;

compensation for all risks, liabilities, and contingencies assigned to the Proposer; and

• all other costs needed or incurred to complete the Project.

6. Pre-Proposal Meeting

See the "Timeline" in the Introduction section (#Introduction). If there is a Mandatory pre-proposal meeting, bidders/proposers are required to attend at the time, date, and location included in the Timeline. If there is a Non-Mandatory pre-proposal meeting, bidders/proposers are not required to attend.

Each bidder/proposer will have the opportunity to clarify and ask questions regarding the Specifications. The Pre-Proposal Meeting will be held at the time, date, and location in the Timeline of this solicitation.

7. Definitions

The words (A) "City", (B) "Department", (C) "Director", or (D) "Contractor", as used in this RFP, shall be understood to refer respectively to (A) the City of Pasadena, California; (B) the several departments therein; (C) the directors of the several City departments; or any of their properly authorized assistants; and ( D) the person, firm or corporation with whom the contract is made by said City or the agent or legal representative who may be appointed to represent such person, firm or corporation in the signing and performance of said contract.

https://procurement.opengov.com/portal/pasadena/projects/205236/document?section=1921338

3. General Requirements

1. Standard terms and conditions

Prior to the award of any work hereunder, City and contractor shall enter into a written contract in substantially the form attached hereto with such revisions thereto as the City may determine necessary and appropriate. PROPOSERS responding to this RFP are strongly advised to review all the terms and conditions of the contract, and shall be deemed to have accepted them.

2. Firm commitment of availability of service

Once a proposal is opened, a PROPOSER is expected to maintain an availability of service as set forth in its proposal for at least four months after date for opening proposals.

3. Reservations

The City reserves the right to reject any or all bids or proposals and any item or items therein, and to waive any non conformity of proposals with this RFP, whether of a technical or substantive nature, as the interest of the City may require.

4. Documents to be construed together

The Request for Proposal (RFP), the Proposal, the Non Collusion Affidavit, and all documents referred to in the complete specifications and the Contract to be entered into between the Contractor and the City, and all modifications of said documents, shall be construed together.

5. Patent fees; patent, copyright, trade secret and trademark fees

Each PROPOSER shall include in the price bid any patent fees, royalties and charges on any patented article or process to be furnished or used in the prosecution of the Work.

6. PUBLIC CONTRACT CODE SEC. 9204 NEW PUBLIC WORKS CLAIMS PROCEDURE

Observe attached details regarding Public Contract Code Section 9204. AB 626, approved by the Governor on September 29, 2016, created a new Public Contract Code Section 9204, which specifies new procedural requirements for claims submitted by a contractor on any public works project. These new requirements contain burdens for both private contractors and public entities and are specifically made applicable to charter cities.

7. Request for Proposal (RFP) quantities:

The quantities contained in the RFP documents are approximate only and are for the sole purpose of comparing proposals. The City may, in accordance with the specifications, request additional services as necessary at the City's sole discretion, as increased by the unit price noted and payment will be made for the amount of services actually provided as determined by the City and accepted at the unit prices noted in the proposal.

8. CHANGE ORDER MANAGEMENT

CHANGE ORDER MANAGEMENT Any additional work identified during the course of the project that is deemed necessary, but outside the original Scope of Services, must be recorded as a Change Order and approved by the City Project Manager in writing before work is started.

9. Taxpayer Protection Act

Under the provisions of the City of Pasadena Taxpayer Protection Act ("TPA"), the Contractor/Organization will be considered a "recipient of a public benefit." The full provisions of the TPA are set forth in Pasadena City Charter, Article XVII. Under the TPA, City public officials who approve this Contract are prohibited from receiving specified gifts, campaign contributions or employment from Contractor for a specified time. As well, if this Contract is to be approved by the City Council, Councilmembers or candidates for Council are prohibited from receiving campaign contributions during the time this Contract is being negotiated (from the due date for an RFP response until award of a contract; this restriction does not apply to competitive and noticed low bid contracts). This prohibition extends to individuals and entities that are specified in the TPA and includes Contractor/Organization and its trustees, directors, partners, corporate officers and those with more than a 10% equity, participation, or revenue interest in Contractor/Organization. Contractor/Organization understands and agrees that: (A) Contractor/Organization is aware of the TPA; (B) Contractor/Organization will complete the forms provided by the City to identify all of the recipients of a public benefit specified in the TPA;

and (C) Contractor/Organization will not make any prohibited gift, campaign contribution or offer of employment to any public official who negotiated and/or approved this Contract, and will not make any prohibited campaign contribution during the time this contract is being negotiated. The Contractor shall submit a copy of the completed TPA form to the City Clerk’s Office if the contract is to be awarded by the City Council via e-mail: OfficialRecords- CityClerk@Cityofpasadena.net or by fax: (626) 744-3921, and submit a copy with the response package. For more information please go to: https://www.cityofpasadena.net/city-clerk/disclosure-reportsax-payer-protection-act-tpa/

10. CONFLICT OF INTEREST STATEMENT ** REVIEW

The proposing Consultant shall disclose any financial, business or other relationship with the City of Pasadena that may have an impact upon the outcome of the contract or any construction project. The Consultant shall also list current clients who may have a financial interest in the outcome of this contract or the construction project that will follow. The proposing Consultant shall disclose any financial interest or relationship with any construction company that might submit a bid on the construction project related to this solicitation. Proposers must complete and submit the following Form: Conflict of Interest Statement

11. Compliance with the Levine Act (Government Code Section 84308)

The Levine Act precludes an officer of a local government agency, including an elected official, from participating in the award of a contract if he or she receives any political contributions totaling more than $500 in the 12 months preceding the pendency of the contract award, and for 12 months following the final decision, from the person or company awarded the contract.

Proposers should ensure their employees, agents, and consultants are aware of the requirements of the Levine Act before the proposal is submitted, so as to avoid inadvertent violations.

12. Payment of Subcontractors, Suppliers, and Workers

The Prime Contractor shall be solely responsible for the payment of all subcontractors, suppliers, laborers, and any other persons or entities employed in connection with the performance of this Contract.

The City shall have no obligation to pay, or to ensure the payment of, any subcontractors, suppliers, or workers directly. The Prime Contractor shall ensure timely and full payment in accordance with all applicable laws, including but not limited to California Public Contract Code §§ 10262 and 10262.5 and Labor Code § 218.7.

Failure to comply with this requirement may result in the withholding of payments, imposition of penalties, and/or other remedies available under the Contract and applicable law.

The Prime Contractor shall also include in all subcontracts a provision requiring subcontractors to pay their lower-tier subcontractors and suppliers in a timely manner consistent with this section.

4. City Requirements

There are forms included in the section named Submittal/Checklist of these specifications which a bidder or proposer must complete to establish compliance with a number of City Requirements, including, but not limited to, equal employment opportunity and affidavit of non-collusion. These forms and their instructions should be considered an integral part of the specifications and failure to complete them may be grounds, in the sole discretion of the city, for rejection of any bidder or proposer.

1. Pasadena Operating Companies

If this solicitation is issued by an Operating Company of the City of Pasadena including the Pasadena Center Operating Company; or Rose Bowl Operating Company; or Pasadena Community Access Corporation: In this solicitation, any reference to the City, shall actually refer to the PCOC, PRHB, or RBOC, or PCAC, e.g. "City" shall refer to the Operating Company, "City Council" to its Board of Directors, and "City Manager" to its Chief Executive Officer.

2. Equal Employment Opportunity in Contracting

Policy - The City of Pasadena is committed to a policy of Equal Employment:

• Contracting. Contractors expressly agree to comply with the City’s ordinances and regulations regarding Equal Opportunity Employment as well as regulations that may be mandated by the source of the funds supporting this contract.

Compliance – To the extent permitted by law, Contractor expressly agrees to establish compliance with the Equal Employment Opportunity Practices Provisions of Chapter 4.08 of the Pasadena Municipal Code, and the Rules and Regulations adopted pursuant to said ordinance.

The successful bidder or proposer may be required to submit documentation during the term of the contract to evidence on going compliance with the City’s Equal Opportunity Practices Provisions. Such documentation may include, but not be limited to certified payroll records and Current Permanent Workforce Utilization reports.

Required Forms – Each bidder or proposer must submit a completed Form AA-1. Failure to submit this form will result in automatic disqualification with no exceptions unless bidder or proposer has an approved Form on file with the City.

Questions regarding Chapter 4.08 of the Pasadena Municipal Code and regulations adopted pursuant thereto should be directed to the Department of Finance, Purchasing Division 626.744.6755.

3. Declaration of Non-Collusion by Contractor

This form is only applied for formal solicitations $75,000 or more. The City requires that each bidder or proposer executes and submits to the City with the Bid/Proposal, the attached Declaration of Non Collusion in the section named "Submittals/Checklist."

4. SAMPLE CONTRACT

A sample of the contract the successful vendor will be required to enter into with the City is attached hereto and by this reference incorporated herein and made part of this solicitation.

5. CHANGE ORDER MANAGEMENT

Any additional work identified during the course of the project that is deemed necessary, but outside the original Scope of Services, must be recorded as a Change Order and approved by the City in writing before work is started.

6. Local Preferences

The City of Pasadena is committed to promoting the economic health and well being of its residents. To this end, contractor agrees to recruit Pasadena residents initially and to give them preference, if all other factors are equal, for any new positions that result from the performance of this contract and which are performed within the City.

7. Pasadena Business License

Awarded bidder or proposer may be required to obtain and pay for any required business license under Title 5 of the Pasadena Municipal Code.

• If the business will not come into the City for the purpose of providing services for this contract they are not required to obtain a business license.

• If the business will only be coming into the city no more than 10 times to work on projects, they are charged 33% of the annual tax (Pasadena Municipal Code Section 5.04.130C)

• If they come into the City more than 10 times they are required to pay the annual fee.

• Any subcontractors used by the awarded bidder or proposer will be required to obtain a license if they will be coming into the City to perform services.

For further information contact Municipal Services Department at (626) 744-4166, Monday- Friday between 7:15 am and 5:15 pm. Additional Information regarding business license fees can be found here: https://www.cityofpasadena.net/finance/licenses/business-licenses/

8. Invoice Submission Portal

Invoice Submission Portal https://www.cityofpasadena.net/finance/licenses/business-licenses/

The invoice submission process is activated when an invoice is submitted through the Vendor Invoice Portal. Invoices submitted are automatically sent to the department being invoiced for review. Once the city department verifies its accuracy, the department will submit the invoice to Accounts Payable for payment processing. One final review and approval by the department who was invoiced is needed in order for a check to be issued. Checks are issued on Tuesday and Thursday.

How to submit invoices to the City of Pasadena?

Create an account: Visit the City’s Invoice Submission website:

https://invoice.cityofpasadena.net/ and select “Create Account”

Refer to the "Invoice Submission Portal - Vendor User Guide" for detailed instructions.

9. Acceptance of Conditions

By submitting a bid or proposal, each bidder or proposer expressly agrees to and accepts the following conditions:

• All parts of the Instructions to bidder or proposer and Specifications will become part of the Contract between the selected bidder or proposer and the City;

• The City may require whatever evidence is deemed necessary relative to the bidder or proposer financial stability and ability to complete this project;

• The City reserves the right to request further information from the bidder or proposer, either in writing or orally, to establish any stated qualifications;

• The City reserves the right to solely judge the bidder or proposer representations, and to solely determine whether the bidder or proposer is qualified to undertake the project pursuant to the criteria set forth herein. The bidder or proposer, by submitting a bid, expressly acknowledges and agrees that the judgment of the City as to whether or not the bidder or proposer is qualified to perform the project, shall be final, binding and conclusive;

• The City reserves the right to reject all bids, waive any irregularity in any of the bids, or cancel or delay the project at any time;

• This bidding process does not commit the City to award any contract, and the City is not liable for any costs incurred by the bidder or proposer in the preparation and submission of a bid.

10. Pasadena Business

Local Business is defined in the Pasadena Municipal Code section:

4.08.020, O: "Local business" means a business with a fixed place of business located in the city.

To receive any preferences offered to a Pasadena business in this solicitation, a Pasadena business must be located within the City Boundary by the release date of this solicitation.

https://invoice.cityofpasadena.net/PortalGuide.pdf

11. Pasadena Living Wage Ordinance

If this purchase includes a service, and the contract total is at $25,000 or more, it is then subject to the City of Pasadena's Living Wage Ordinance, Pasadena Municipal Code Chapter 4.11. The ordinance requires that contractors providing labor or services to the City under contracts in excess of $25,000 pay no less than the City’s Living Wage to all employees who spend any of their time providing labor or delivering services to the City.

The selected contractor will be required to evidence compliance with the Living Wage Ordinance by submitting payroll records as requested by the City. Each record shall include the full name of each employee performing labor or providing services under the contract; job classification; rate of pay and benefit rate.

Failure to comply with the provisions of the Pasadena Living Wage Ordinance is grounds for termination of the contract and a basis for penalties as stated in Pasadena Municipal Code Chapter 4.11. Questions concerning the Pasadena Living Wage Ordinance should be directed to:

Finance Department Purchasing Division 626-744-6755 - phone 626-744-6757 – fax

Please visit https://ww5.cityofpasadena.net/finance/doing-business-with-the-city/ for the current calendar year Pasadena Living Wage rate.

12. PAYMENT OF A CITY-WIDE MINIMUM WAGE

If a vendor is providing labor for any subsequent contract resulting from this solicitation, they must comply with the City of Pasadena Minimum Wage as set forth in Chapter 5.02 of the Pasadena Municipal Code. Vendors are encouraged to review the City’s minimum wage information guide at (https://bit.ly/3o3SHMh). The minimum wage ordinance may be found at Pasadena Municipal Code.

13. Errors and Omissions

Bidders or Proposers shall not be allowed to take advantage of any errors or omissions in the Instructions to Bidders/General Instructions or Specifications/Scope of Work. Full instructions will be given if such error or omission is discovered and timely called to the attention of the City.

14. Patent Fees; Patent, Copyright, Trade Secret, and Trademark Fees

Each bidder or proposer shall include in the price bid any patent fees, royalties and charges on any patented article or process to be furnished or used in the prosecution of the Work.

15. Taxes

Price bid or Price Proposals shall include all federal, state, local and other taxes.

https://ww5.cityofpasadena.net/finance/doing-business-with-the-city/ https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbit.ly%2F3o3SHMh&data=05%7C02%7Cawatson%40cityofpasadena.net%7Cbb892f95fde0404d371508dc9bbbf790%7C82d9fc002c664402a28fc6bcdc32e491%7C1%7C0%7C638556478819490734%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=zhx6795nsAtQnJvmzYHL5q2Lzw%2FdOCl95da3qPj4Duw%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Flibrary.municode.com%2Fca%2Fpasadena%2Fcodes%2Fcode_of_ordinances%3FnodeId%3DTIT5BULIRE_ARTIGE_CH5.02PACIDEMIWA&data=05%7C02%7Cawatson%40cityofpasadena.net%7Cbb892f95fde0404d371508dc9bbbf790%7C82d9fc002c664402a28fc6bcdc32e491%7C1%7C0%7C638556478819500215%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=AX1DEPBi2FxNNRsdiRGGB1whWvtl2jG%2FQ7SO5QsB%2Fac%3D&reserved=0

16. Certificate of Insurance

Proof of insurance is not required to be submitted with your bid/proposal, but will be required prior to the City's award of the contract. Refer to the Insurance requirements in the Insurance Requirements section of this document.

17. REQUEST FOR TAXPAYER IDENTIFICATION NUMBER AND CERTIFICATION (IRS Form W-9)

The winning proposal/bid may be required to submit a completed and signed IRS Form W-9.

Failure to submit this form may result in the response being deemed non-responsive.

Link: https://www.irs.gov/pub/irs-pdf/fw9.pdf

18. LIMITATIONS ON LIABILITY

Bidders acknowledge that they shall provide the goods and/or services without monetary limitations on liability. If Bidders take exception to this requirement, Bidders shall expressly state any exceptions, including the proposed limits of liability, (a) in detail; (b) as a separate line item;

and (c) not part of any form documents submitted. Bidders acknowledge that any exceptions may result in a finding of non-responsiveness.

19. Recycled Product Procurement Mandates Pertaining to Local Governments [Public Contract Code Sections 22150 - 22154]

This section is only applied when buying paper products.

Beginning January 1, 2022, SB 1383 requires jurisdictions (cities, counties, cities and counties, or special districts that provide solid waste collection services) to purchase recycled-content paper products that are recyclable.

SB 1383 builds upon existing laws that require jurisdictions to purchase products that contain minimum recycled content, and adds additional requirements on product recyclability and recordkeeping.

All vendors providing Paper Products and Printing and Writing Paper shall:

• Provide products that contain no less than 30% minimum recycled content and recyclability (described in further detail in State of California, Public Contract Code Sections 22150-22154, under the sections “Recycled-Content Requirements” and “Recyclability Requirements”.

• Provide a written certification and other verification from product vendors, as applicable, certifying that the products meet the recycled-content and recyclability requirements.

20. AVAILABILITY OF FUNDS

https://procurement.opengov.com/portal/pasadena/projects/205236/document?section=1921353 https://procurement.opengov.com/portal/pasadena/projects/205236/document?section=1921353 https://www.irs.gov/pub/irs-pdf/fw9.pdf https://www.irs.gov/pub/irs-pdf/fw9.pdf https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fleginfo.legislature.ca.gov%2Ffaces%2Fcodes_displayText.xhtml%3FlawCode%3DPCC%26division%3D2.%26title%3D%26part%3D3.%26chapter%3D3.5.%26article%3D&data=05%7C01%7Cawatson%40cityofpasadena.net%7C307f17457fcb49d363c108dbba309d38%7C82d9fc002c664402a28fc6bcdc32e491%7C1%7C0%7C638308490511442074%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=kSzPLWUdh6HYJTjfSaMqzITXO6TDf1tcUTo%2BcAV5SJw%3D&reserved=0

The provisions of this Contract relating to payment for products or services shall become effective when funds assigned for the purpose of compensating the Contractor as herein provided are actually available to for disbursement. The City shall be the sole judge and authority in determining the availability of funds under this Contract. If any action is taken by the City, any state agency, Federal department or any other agency to suspend, decrease, or terminate its fiscal obligations under, or in connection with, this Contract, the City may amend, suspend, decrease, or terminate its obligations under, or in connection with, this Contract. In the event of termination, The City shall be liable for payment only for products provided or services rendered prior to the effective date of the termination, provided that such products or services were provided or performed in accordance with the provisions of this Contract.

21. Addenda

If any person contemplating submitting a proposal of the items or services listed herein is in doubt as to the true meaning of any part of this RFP, he/she may submit a question through the City's eProcurement Portal Q&A section for an interpretation or correction thereof.

Any interpretation or correction of City specifications will be made only by addendum, duly issued by the City representative(s) identified in this solicitation, above. Addenda (if any) shall be made available on the City's eProcurement system, and sent to each vendor included on the "Followers" list in the City's eProcurement system. A vendor's failure to address the requirements of any and all addenda may result in the response (proposal or bid, or alike) not being considered. If the City determines that a time extension is required for the proposal, the City will issue an addendum that will give the new submission date. The vendor is responsible to register on the City's eProcurement Portal and follow the project named Managed Detection and Response (MDR) Services [P-67709] in order to be included in the "Followers" list in the City's eProcurement system to insure they receive all documents including addendums which are available as a download.

The City reserves the right to change any part of these Instructions to PROPOSERS and Specifications any time prior to Deadline for Submissions. Any changes shall be in the form of addenda and will become a part of the Proposal documents and of the contract.

https://procurement.opengov.com/portal/pasadena

5. Insurance Requirements

Proof of insurance is not required to be submitted with your bid or proposal. However, proof of insurance with the lines of coverages and policy minimums as listed below will be required prior to the City's award of any contract. The City of Pasadena reserves the right to modify these requirements, including lines of coverage and limits, based upon the nature of the risk, prior experience, insurer, coverage, or other special circumstances.

1. Insurance Requirements

See Insurance Requirements in Attachments Section

2. Acknowledgement of Requirements

Submission of a response to this bid spec or RFP shall be deemed acknowledgment and acceptance of the insurance requirements as outlined herein and in any referenced documents.

6. Information Technology Requirements

1. Data Ownership

The City retains all rights, title and interest in data and information input, uploaded, transmitted, or otherwise provided by or on behalf of the City into the vendor provided solution (“Organizational Data”). All Organizational Data shall remain the sole and exclusive property of the City. Vendor has no rights to use Organizational Data for any purpose other than to deliver the services contracted, unless otherwise authorized in writing by the City. Upon termination of any agreement between the City and vendor, the Organizational Data will be provided to the City, including uploaded documents and attachments, in an industry standard format such as csv, json or xml, or other agreed upon format at that time.

2. Data Sovereignty

The vendor provided solution must keep all data and information within the United States, including when information is stored as part of a backup, unless otherwise authorized in writing by the City.

3. Data Security

The vendor provided solution must protect and secure all data and information input to the system, including documents and attachments. Information must be protected by AES 128-bit or greater encryption. Information must be encrypted in transit between the solution and the user’s web browser. The solution must encrypt all data stored at rest, including on disk, within databases and when information is maintained external to the solution, such as part of a backup or a data export, unless otherwise authorized in writing by the City.

4. Compelled Data Disclosure

In the event vendor receives a subpoena, court order, or other legal process requesting access to or disclosure of any Organizational Data, the vendor shall promptly notify the City in writing, unless legally prohibited from doing so, and shall cooperate with City in seeking a protective order or other appropriate remedy. Any disclosure of Organizational Data in response to legal process must be authorized in writing by the City, unless prohibited by law.

5. Data Storage

The vendor shall not permit the storage of City data and information on vendor mobile or removable devices (e.g. laptops, USB drives, removable drives, optical disks, etc.) except for limited purpose and duration, and only if authorized in writing by the City. Any such use also requires that vendor meets the data security requirements as noted above, ensuring that all storage on mobile or removable devices is appropriately encrypted and protected.

6. Data Deletion

Upon termination of this agreement, or upon written request by the City, the vendor shall permanently delete all City data and information from its systems, including backups and any other repositories under vendor's control, within thirty (30) days, unless retention is required by law or authorized in writing by the City. Deletion must include all documents, attachments, and any derivative data, and shall be performed in accordance with recognized industry standards for secure data erasure. Upon completion of data deletion, the vendor shall provide the City with written certification confirming the destruction of all relevant data.

7. Artificial Intelligence (AI) Usage Disclosure

The vendor shall fully disclose any use of Artificial Intelligence (AI), Machine Learning (ML), or automated decision-making technologies within the proposed solution. This includes, but is not limited to, the specific functions where AI is used, the nature of the AI model (e.g., predictive, generative, or rule-based), and whether the AI is proprietary, third-party, or open-source. The vendor shall also disclose whether any AI models are shared across multiple customers or tenants. The City reserves the right to approve or reject the use of AI components based on risk, transparency, and alignment with City policies.

8. Prohibition of Use of City Data for AI Training

The vendor shall not use any City data or information to train, fine-tune, or otherwise improve any AI or ML models, whether proprietary, third-party, or public, without the City’s express written consent. This includes a prohibition on using City data for training public or shared models. If AI models are used, the vendor must ensure City data is excluded from any datasets used for model development or refinement unless explicitly authorized in writing by the City.

9. AI Feature Transparency and Choice

AI Feature Transparency and Choice – The vendor shall disclose whether the proposed solution includes Artificial Intelligence (AI), Machine Learning (ML), or automated decision-making technologies that are integral to its functionality. Where feasible, the vendor should provide mechanisms that allow the City to configure or limit the use of such features. The City recognizes that opting out of AI features may reduce functionality; however, vendors are expected to design solutions that support informed decision-making by clearly identifying which features rely on AI and whether such features are optional or required.

7. Scope of Work

Using the City's Microsoft 365 for Government tenant, the selected vendor shall establish a tenant-resident 24x7x365 Managed Detection and Response (MDR) service while providing full operational control of the SOC function, including the onboarding of all entitled devices for approximately 2,500 Microsoft 365 licensed users.

The vendor shall manage all detection, response, and tuning activities within the City's tenant.

The vendor shall deliver Tier 1 endpoint detection, containment, and remediation services. The goal is to enable our internal teams to focus on higher-tier analysis and strategic initiatives, while also building a sustainable, co-managed environment that remains fully functional and documented within the City’s tenant. All telemetry, rules, alerts, playbooks, and configurations for optimal security operations will reside within the tenant to ensure portability and continuity over time.

The initial scope centers on endpoint protection and Microsoft-native telemetry, but the architecture should be designed with future expansion in mind — including integration of identity, network, and infrastructure logs to support broader correlation and detection capabilities.

This RFP anticipates the requirement of additional Microsoft licensing. Vendors shall use the Microsoft 365 G3 and F3 licenses as the presumed standard baseline available for all staff. Vendor proposals must clearly identify any Microsoft license requirements that exceed entitlements of the G3 or F3 licenses. Where multiple license options are available to address requirements, vendors should focus on licensing that effectively balances a license's entitlements/capabilities, the capabilities required to deliver vendor's proposal, and the license's projected costs.

Note: Procurement of Microsoft licenses is not included within this solicitation and will be completed through the City's existing Microsoft EA, if necessary.

1. Core Deliverables

The selected vendor shall provide a comprehensive, tenant-resident Managed Detection and Response (MDR) service that supports the City of Pasadena’s strategic cybersecurity objectives.

Core deliverables shall include, but are not limited to:

• Tier 1 Endpoint Detection and Response (EDR):

Provide 24x7x365 monitoring, triage, containment, and remediation of endpoint threats using Microsoft Defender and related tools, with clearly defined escalation paths for Tier 2+ incidents. Vendors may propose optional or value-added Tier 2 capabilities, such as advanced investigation, threat hunting, or root cause analysis, as part of their base offering or as separately priced services.

• Tenant-Resident SOC Operations:

Operate entirely within the City’s Microsoft 365 tenant, ensuring all telemetry, rules, alerts, playbooks, and configurations are accessible to City staff and remain under City ownership.

• Co-Managed Visibility and Access:

Ensure City cybersecurity personnel have real-time access to the same data, alerts, dashboards, and tools used by the vendor, enabling transparency, collaboration, and operational continuity.

• Detection Engineering and Tuning:

Develop, implement, and continuously refine detection rules, alert thresholds, and automated response playbooks tailored to the City’s environment and risk profile.

• Incident Response Support and Root Cause Analysis:

Provide deep-dive incident investigations, including root cause analysis and forensic support, on an as-needed, time-and-materials basis under pre-negotiated rates.

• Operational Reporting and Recommendations:

Deliver regular reports that go beyond activity metrics to include actionable insights, trends, and recommendations for improving the City’s security posture and internal processes.

• Documentation and Knowledge Transfer:

Maintain up-to-date documentation of all configurations, rules, playbooks, and procedures. Provide knowledge transfer to City staff to support long-term operational maturity.

2. Technical and Platform Requirements

The selected vendor shall deliver all MDR services within the City of Pasadena’s Microsoft 365 tenant. The solution must be designed to ensure transparency, co-management, and long-term sustainability. Technical and platform requirements include, but are not limited to:

• Microsoft Tenant Residency:

All MDR operations — including telemetry ingestion, analytics rules, alerting, playbooks, and automation — must be implemented and executed within the City’s Microsoft 365 tenant. No telemetry or operational data shall be exported to vendor-owned infrastructure or third-party platforms without prior written approval.

• Tooling and Platform Use:

The vendor shall utilize Microsoft-native tools and services, including but not limited to:

o Microsoft Defender for Endpoint o Microsoft Sentinel o Microsoft Defender for Office 365 o Microsoft Purview Audit The solution shall leverage Microsoft Purview Audit (Standard) capabilities. Vendors may propose use of Audit (Premium) features where they provide clear operational value. Any such requirements must be clearly identified, including associated licensing implications.

o Microsoft Intune Integration The vendor shall leverage Microsoft Intune as part of the endpoint protection and response architecture. This includes onboarding devices into Microsoft Defender for Endpoint, enforcing security baselines, deploying configuration profiles appropriate to support MDE, and supporting automated remediation actions where appropriate.

The vendor shall ensure that Intune policies and configurations align with Defender and Sentinel operations and are documented for City staff visibility and continuity.

o Microsoft Defender for Identity (Optional) The City currently does not license this product nor expect to include it in the base implementation. The vendor may propose use of Microsoft Defender for Identity where it provides clear value to detection and response capabilities. Any such proposal must:

▪ Clearly identify the associated licensing requirements and costs

▪ Justify the operational benefits of including MDI

▪ Explicitly state which features, functions, or detection capabilities would be unavailable or degraded if MDI is not included

• Telemetry Integration and Visibility:

The solution must support integration of the following telemetry sources within the initial implementation, where necessary to support the prescribed deliverables of this SOW, or as part of a defined future enhancements roadmap:

o Endpoint telemetry (e.g., Windows, iOS, Android devices) o Microsoft 365 audit logs o Azure AD sign-in and activity logs o AD Identity and authentication logs o DNS and DHCP logs o Firewall logs (targeted sources) o Server infrastructure telemetry (e.g., Windows Server, hypervisor and storage platforms, etc.)

• Security and Access Controls:

The vendor shall operate under least-privilege principles and use role-based access controls (RBAC) within the City’s tenant. All access must be auditable and subject to City approval.

• Licensing Awareness:

The vendor shall identify any additional Microsoft licensing requirements necessary to support the proposed solution. Licensing procurement will be handled separately through the City’s existing Microsoft Enterprise Agreement.

3. Implementation and Onboarding Services

The selected vendor shall lead the implementation and onboarding of the MDR service in close coordination with City staff. The implementation phase must be structured, transparent, and designed to ensure operational readiness, knowledge transfer, and alignment with the City’s Microsoft 365 environment. Implementation services shall include, but are not limited to:

• Project Planning and Kickoff:

Develop and deliver a detailed implementation plan, including timelines, milestones, roles and responsibilities, and communication protocols.

• Endpoint Onboarding and Baselining:

Enroll all in-scope Windows 11 endpoints for up to 2,500 users into Microsoft Defender for Endpoint using Microsoft Intune or alternative methods. Validate telemetry flow into Microsoft Sentinel and ensure visibility into endpoint health, compliance, and threat activity.

• Microsoft Sentinel Configuration:

Configure Microsoft Sentinel within the City’s tenant, including:

o Data connectors for Microsoft 365, Defender, Azure AD, and other available sources o Initial analytics rules, workbooks, and dashboards o Role-based access controls (RBAC) for City and vendor staff o Alerting and escalation workflows

• Playbook and Automation Setup:

Develop and deploy automated response playbooks using Logic Apps or other Microsoft-native tools. Playbooks must align with pre-approved containment actions and escalation paths.

• Detection Tuning and Rule Development:

Customize and tune analytics rules to reflect the City’s environment, risk profile, and operational priorities. Include suppression logic, false positive reduction, and alert prioritization.

• Documentation and Knowledge Transfer:

Document all configurations, rules, playbooks, and onboarding procedures. Provide walkthroughs and working sessions with City staff to ensure operational understanding and continuity.

• Licensing Requirements Identification:

Identify any additional Microsoft licensing required to support the proposed solution (e.g., Defender for Identity, Sentinel capacity, Logic Apps). Licensing procurement will be handled separately by the City.

• Additional Enhancements:

Vendors may propose additional onboarding services, such as integration of non- Microsoft telemetry sources (e.g., DNS, DHCP, firewall logs), deployment of Defender for Identity, or onboarding of mobile devices,…