Q&A Document 1.pdf

Questions & Answers - 1

Solicitation 2024-6 - CyberSecurity

Buying Organization Pueblo County School District 70

No Question/Answer Question Date

Q1 Question: Question Concerning Sophos

Looks like you already have Sophos as your EDR, but in the doc you referr to it as “ERD”…we would essentially be replacing the Sophos so we need to know if you are willing to rip Sophos?

Answer: We would like to retain Sophos

12/10/2024

Q2 Question: Network Manufacturer

Which network manufacturer do you use?

Answer: Ruckus is the network manufacturer

12/12/2024

Q3 Question: Sophos Licensing

What level of Sophos licensing do you have?

Answer: InterceptX Advanced

12/12/2024

Q4 Question: Palo Alto Firewalls

How many Palo Alto firewalls do you have, and what subscription(s) have you purchased?

Answer: We have one

12/12/2024

Q5 Question: Ease of Use

Can you expand on your expectation that the proposed solution will not require a dedicated staff member? Can you describe how alerts and remediations hard handled today and what your ideal scenario would be with the proposed solution?

Answer: We are looking for an automatic remediation with vendor staffing/AI

12/12/2024

Q6 Question: Active Directory

Is your Active Directory on premises, hybrid, or all in Entra?

Answer: Hybrid model

12/12/2024

Q7 Question: Microsoft Licensing

Regarding O365, which Microsoft license level do you utilize?

Answer: Education Licensing

12/12/2024

No Question/Answer Question Date

Q8 Question: Contract History and Incumbent Information

Q1) is there an incumbent contractor currently providing cybersecurity services to Pueblo County

School District 70?

1b) If yes, could you provide details about the incumbent contractor’s performance, the scope of their contract, and any specific challenges or gaps observed in the current solution?

1 c) Are there particular lessons learned or feedback from the existing contract that should inform the requirements for this RFP?

1d) Is this RFP intended to identify a new service provider, or is the incumbent eligible to bid on this contract?

Answer: No current contractor

12/13/2024

Q9 Question: General Questions

Q2 a) Could you clarify the budget range or constraints for this project to ensure our proposal aligns with available funding?

Q2 b) Beyond the technical requirements outlined, are there specific compliance frameworks (e.g., NIST, CIS, CMMC) that the cybersecurity solution must adhere to?

Answer: RFP defines this question

12/13/2024

Q10 Question: Scope and Requirements

3 a). How many locations within the district require coverage under this cybersecurity solution? Are remote locations included in the scope?

3b) Could you provide details on the number and type of endpoints (e.g., MacBooks, Chromebooks, Windows/Linux servers) needing protection under SIEM and SOC monitoring?

3 c) Are there any existing identity and access management systems for managing Google Accounts, Office 365, or other platforms, and should the proposed solution integrate with them?

3 d) Are there specific metrics or KPIs you want the solution to achieve (e.g., average time to detect/respond to threats, reduction in cybersecurity incidents)?

3 e) Could you elaborate on the role and configuration of the Palo Alto firewall and Sophos antivirus in your current environment? Is integration with existing tools or replacement preferred?

Answer: 21 Schools; 2 Admin complexes. 12,000 end point. Purpose of the system is to protect the sites and end points.

12/13/2024

Q11 Question: Monitoring and Response

4 a) Do you have a preference for the staffing model for 24/7 cybersecurity monitoring and response

(e.g., vendor-hosted SOC vs. on-premises team)?

4 b) Should the incident response include direct remediation actions by the vendor, or would guidance for district staff suffice?

4 c)How would you like threat analysis and automated response workflows reported (e.g., real-time dashboards, automated alerts, periodic reports)?

Answer: Vendor monitored 24/7 with remediation.

12/13/2024

Q12 Question: AI and Automation

5a) What specific functionalities are expected from the AI threat analysis system beyond general threat detection (e.g., behavior analytics, anomaly detection)?

5b) Are there particular firewalls or endpoint response devices that need to be leveraged for automated attack responses?

Answer: System needs to be able to work with Sophos to isolate end points detected. System also needs to work with Palo Alto to block outgoing communications.

12/13/2024

Q13 Question: Implementation and Support

6a) Will the contractor have direct access to district IT resources during the implementation phase?

What level of support will district staff provide?

6b) Should training sessions for district staff be included in the proposal? If so, what level of expertise is expected (basic, intermediate, or advanced)?

6c) Are there preferences for the vendor’s support model (e.g., on-site, remote, or hybrid)?

Answer: System access would be coordinated through central staff and be monitored.

12/13/2024

Q14 Question: Visibility and Reporting

7a) Are there preferred formats or tools for reporting visibility and context about attacks?

7b) How frequently should reports be provided (e.g., weekly, monthly, quarterly), and what level of detail is expected?

Answer: A vendor supplied console and other communication as agreed upon

12/13/2024

Q15 Question: Timeline and Deadlines

8a) Are the timelines for implementation and service delivery flexible?

8b) Are there specific milestones or interim deadlines (e.g., partial deployments) that must be met before the full implementation by February 7th?

Answer: Yes we can collaborate with timelines for implementation by Feb 7th. There would be a system testing phase before full implementation

12/13/2024

Q16 Question: Forensic and Audit

9a) Following the recent data breach, is there an opportunity for a forensic investigation to identify previous vulnerabilities?

9b) Does the district plan to include penetration testing and security audits as part of this RFP? If not, is it a consideration for future phases?

Answer: This is not part of this RFP

12/13/2024

Q17 Question: Evaluation Criteria

10 a)How will cost-effectiveness be evaluated in terms of ROI over the product lifecycle?

10b) Are specific scoring weights assigned to compliance, vendor capacity, cost, or references during the evaluation process?

Answer: A D70 team will evaluate RFPs

12/13/2024

Q18 Question: References and Case Studies

11 a) Should reference projects feature a similar student population size or technological environment to Pueblo D70’s for relevance?

Answer: Yes reference projects should be similar referenced would be helpful

12/13/2024

Q19 Question: Asking for Questions

Hey team.

I hope you are doing well.

I am working on this opportunity. Could you please answer the below question so we can provide you with the quote?

I received your request for this Pueblo County RFP to be quoted, however, the only documentation I have is the attached Scope of Work describing the RFP.

Did you have a Bill of Materials or list of requested SKU’s/quantities for this RFP?

Answer: We don't have a bill of materials; this will be specific to your solution

12/16/2024

Q20 Question: Scope of Services

1. Could you provide an approximate count of each asset type (e.g., MacBooks, Chromebooks, Windows Servers, Linux Servers, endpoints)?

2. Are there any existing security tools currently deployed (e.g., EDR, antivirus, firewalls, SIEM)? If so, what are they? If so, should the 24/7 monitoring solution integrate with existing tools such as SIEM, firewalls, or endpoint solutions?

3. Are there any existing AI-based tools deployed (e.g., behavior analysis or automated remediation tools)?

Answer: 5,000 MACS; 11,000 Chromebooks, 600 Windows Machines. Yes it should integrate. We have firewalls and antivirus deployed and the system should integrate with both of these.

12/17/2024

Q21 Question: Question for 2024-6 - CyberSecurity

1. Please mention count for Macbook, Chromebook, Windows Server, Linux Server along with OS architecture, name and types where applicable, category wise.

2. Please confirm, any EDR technology exists in their environment which provides granular process level details? Please comment along with the name.

3. Please list coverage of Sophos along with the type, mentioned in point 1, such as macbook, chromebook, windows server, linux server.

4. For Google account and office 365, does control assessment for policies suffice your requirement?

Please comment.

5. For office 365, can you mention license types such as E3,E5 or any.

6. Does macbook, chromebook, windows server and linux server coverage require features such as triage, quarantine, process blocking or alerts based on logs configured can suffice your requirement?

Please comment.

7. Please mention a number of distinct sites, where coverage is required, if any.

8. What is the eligibility requirement for selection?

9.Any qualifications and certifications needed?

Answer: Office and Google for Education. 5000 MACS, 11000 Chromebooks, 600 Windows, 21

Schools with 2 admin sites. 52 windows serves, 2 Linux servers.

12/17/2024

Q22 Question: General questions

1.How many users in Google Workspaces? Microsoft 365?

a.How many Staff/Faculty? Students?

2.What student grade levels have external email capability? ie how many of the students need to be protected from phishing?

3.Are the students on BYOD or school issued tablets/laptops?

4.How widespread is Sophos currently being deployed and where?

5.Are there protections in place for sensitive data?

6.What tools are being managed in house today vs what will be managed by responder?

Answer: 10,000 students, 1500 staff; all students and staff have email/google accounts. All devices are district issued.

Accounts are managed by local active directory and google admin

Q23 Question: Technical Infrastructure Assessment Questions

Current Technology Stack

• What is the current technology stack, specifically regarding EDR, Firewall, DLP, and MDM solutions?

• Details about any existing SIEM, EDR, or MDR solutions that require integration or migration

• Information about security tools and platforms beyond Palo Alto Firewall, Active Directory

DHCP, and Sophos Antivirus

System Environment

• Detailed breakdown of operating systems across the environment (Windows, Mac, Linux, ChromeBook) with quantities

• Approximate number of endpoints by type requiring monitoring

• Information about on-premises servers and infrastructure

Security and Monitoring

• Current log management infrastructure and data source details

• Log retention policies and approximate daily ingestion volume

• Current endpoint security architecture and desired EDR capabilities

• Google Accounts and Office 365 protection features currently enabled

• Scope of cloud assets requiring protection (users, data volume, workloads)

Business Operations

• Identification of business-critical components

• Compliance requirements and regulatory frameworks

• Email solution in use (M365 or Google Workspace)

• APIs currently in use

• RMM tool status and deployment requirements

Operational Requirements

• Incident response procedures and integration expectations

• Specific requirements for security logs and incident retention

• Details about automated response requirements for attacks using existing Firewalls and

EDR

• Integration requirements with Palo Alto Firewall

• Expected response times and escalation procedures for 24/7 monitoring

• Reporting requirements and dashboard needs for different stakeholder groups

Answer: We have Sophos InterceptX advanced licensing as endpoint protection and automated response for attacks. Palo Alto firewall with filtering enabled for general district protection.

12/17/2024

Q24 Question: CyberSecurity

How many employees are in the organization?

Answer: 1600 employees

12/17/2024

Q25 Question: CyberSecurity

What are the number and type of firewalls in place?

Answer: One firewall in place

12/17/2024

Q26 Question: CyberSecurity

What type of endpoint protection or anti-malware solution is being used?

Answer: Sophos InterceptX Advanced.

12/17/2024

Q27 Question: CyberSecurity

What type of IDS/IPS solution is implemented?

Answer: Mix of Microsoft and Google Tools

Q28 Question: CyberSecurity

Is there a NetFlow solution in place?

Answer: Their is not a NetFlow solution in place

12/17/2024

Q29 Question: CyberSecurity

Please list the cloud services or environments in-scope (e.g., O365, AWS, etc.).

Answer: Google and Microsoft

12/17/2024

Q30 Question: CyberSecurity

How many servers are in scope, and what types are they?

Answer: 52 Windows; 2 Linux

12/17/2024

Q31 Question: CyberSecurity

How many PCs and laptops are in-scope, and what types are they?

Answer: 5000 MACS; 600 Windows; 11000 Chromebooks

12/17/2024

Q32 Question: CyberSecurity

What level of response is requested?

Answer: 24/7 solutions

12/17/2024

Q33 Question: CyberSecurity

Should the team validate and escalate issues only, with 24x7 response support as needed?

Answer: 24/7 response with all security issues with remediation.

12/17/2024

Q34 Question: CyberSecurity

Should issues be validated and escalated during business hours, with remediation following a defined

SOP during off-hours?

Answer: 24/7 remediation response

12/17/2024

Q35 Question: CyberSecurity

Are there any additional services to bundle, such as:

a.Vulnerability management?

b.Phishing or awareness training?

c.Annual IT risk assessment?

d.Audit or advisory support?

Answer: Not at this time

12/17/2024

Q36 Question: CyberSecurity

If there are multiple locations, how do the sites communicate both via network and the internet?

Answer: Through a fiber optic network

12/17/2024

Q37 Question: EDR Licensing

What type of Microsoft licensing is in place? If not E3 or E5 is there an alternative Endpoint Detection and Response technology in use?

Answer: Educational Licensing

Q38 Question: Logging Management

Are there any regulatory requirements or needs outlined for retention of logs?

Answer: Retention should be one month

12/17/2024

Q39 Question: Device Scope

Does Pueblo School District require their students devices to be included or just the Pueblo Schools knowledge workforce?

Answer: Students should be included

12/17/2024

Q40 Question: Genearl Questions

•Does the District currently use a Managed Detection and Response (MDR) service?

•What are the current user counts for the District? If possible, please provide a breakdown by Staff, Teachers and Students.

•How many Windows endpoints does the District have?

•How many Mac endpoints does the District have?

•How many Chromebooks does the District have?

•How many Windows servers does the District have?

•How many Linux servers does the District have?

•Which Linux distributions are being used by the District?

•Please provide clarification for the "Automated Responses to Attacks using existing Firewalls and ERD" requirement on Page 1 of the RFP

•Please provide clarification for the "Google Accounts" requirement on Page 1 of the RFP

Answer: Sophos InterceptX Advanced; 1600 Staff; 10,000 students. 600 end points Windows; 11,000

Chromebooks, 5,000 MACS. 52 Windows servers, 2 Linux servers. UBUNTU.

Google accounts are not part of the response.

12/18/2024

Q41 Question: Extension and terms

1.With the Holiday Season occurring in the middle of our proposal response, we respectfully request an extension of one week to prepare our response. Please advise if this extension can be granted.

2.What is the desired contract term? One year? Three Years? One year minimum with one-year extensions?

3.What are the desired contract billing terms?

4.Does the district anticipate any change in the user count during the duration of the contract?

5.What is the award criteria?

Answer: We need to adhere to timeline in RFP. Please provide the options your company offers. A

D70 team will evaluate RFPs

12/18/2024

Questions & Answers - 1