RFP 26-07 Questions & Answers.pdf

May 27, 2026 Page 1 of 8

695 Moores Creek Lane | Charlottesville, Virginia 22902-9016 434.977.2970 434.293.8858 www.rivanna.org

QUESTION AND RESPONSE LIST

May 27, 2026

Request for Proposal: 26-07 Title: Support Services for Information Technology, Scada, and Industrial Controls

Dated: May 6, 2026 RFP Due Date and Time: Thursday, May 28, 2026, 3:00 PM EST

Many of the questions received were duplicative, therefore, may not appear in this document.

1. Is it possible to do a site visit?

Response: Presently, we cannot accommodate an on-site visit. The RWSA operates and maintains the assets listed:

95 Primary Logic Controllers (PLCs)

25 SCADA services

23 Operator Interface Terminals (OITs)

Numerous software packages for data storage, retrieval, and visualization

40+ General IT servers

150+ Workstations

85+ Laptops

40+ Printers and like devices

25+Routers

75+ Network switches

75+ Smart UPSs

Internet connections from multiple vendors

2. Any projects you’d like to have handled in the commission of onboarding?

Response: No projects needed for onboarding. We expect vendors to work with our team to identify potential projects such as asset validation, documentation, monitoring deployment, and backup verification.

3. Rough seat count of users, computers, and physical servers?

Response: Refer to question #1

4. Is the preference to be fully onboarded into where routine maintenance tooling, cybersecurity, data protection, O365 etc. solutions are delivered through our managed channels? Or are you seeking some sort of co-managed scenario?

Response: We are open to either scenario

5. What cybersecurity framework or standards are followed (e.g., NIST CSF, ICS-Cert, AWIA, State Regulations, etc.)

Response: NIST SP 800-53, CIS Controls v8, AWWA Water Sector Cybersecurity practices, EPA/VDH (AWIA-driven), MC-ISAC/WaterISAC

6. Has a cybersecurity risk assessment or vulnerability assessment been performed on the OT/ICS environment? Is that something of interest?

Response: Yes, it has been performed. Yes, we are interested.

May 27, 2026 Page 2 of 8

7. How many OT/ICS network segments or zones exist across the 30+ facilities?

8. Is there an OT Specific Incident Response Plan, or would developing/updating the plan be in scope?

Response: Yes, updating would be the plan in a scope.

9. Is there an incumbent vendor currently supporting any portion of the IT, SCADA/ICS, cybersecurity, ERP, or GIS environment? If yes, please provide the vendor name(s) and supported scope areas.

Response: We work with several vendors

10. Can the Authority provide a high-level overview of the current technology environment, including major SCADA, PLC, cloud, firewall, and cybersecurity platforms?

11. Are any third-party vendors currently providing NOC, SOC, MDR, or managed cybersecurity services?

Response: Yes

12. Does the Authority anticipate multiple awards by service area or a multi-domain award structure?

13. Approximately how many vendors are expected to be awarded?

Response: Several

14. Will task orders be competitively issued among awarded vendors?

15. Is there any estimated annual spend or budget range for this contract?

16. Approximately how many internal IT personnel currently support the environment?

Response: 10

17. What is the expected onsite versus remote support ratio?

Response: TBD

18. Are subcontractors permitted?

19. Are vendors expected to provide 24x7 SOC or incident response support?

20. What ERP/financial systems are currently in use?

Response: Detailed information will be disclosed if awarded

21. What versions of Cityworks, ESRI, and DocLink are currently deployed?

22. Are resumes required for all proposed personnel or only key personnel?

Response: Yes, all vendors will be vetted

May 27, 2026 Page 3 of 8

23. Is there a minimum number of references required?

Response: Yes, 3

24. May vendors propose additional labor categories beyond those listed in Appendix A?

25. Will the Authority consider negotiation of the $5M professional liability requirement based on awarded scope?

26. Will cyber liability insurance also be required?

Response: Your general liability should cover any losses that you are fault for. Cyber liability insurance usually covers outside attack and incident and response.

27. Is electronic submission through eVA alone sufficient?

28. Given the upcoming public holiday and anticipated timing of Q&A responses, would the Authority consider a brief extension to the proposal due date to allow vendors sufficient time to prepare a compliant response?

Response: No

29. Can the Authority provide an estimated count of IT and OT/ICS assets in scope, including servers, endpoints, network devices, PLCs, HMIs/OITs, SCADA servers, Ignition/Historian platforms, and other critical systems?

30. Can the Authority confirm the number of facilities/sites that may require support and whether all sites are covered by the four-hour emergency response requirement?

Response: All sites

31. Can the Authority provide a high-level breakdown of cloud-hosted, on-premises, and hybrid systems currently in scope?

32. Can the Authority identify the primary cybersecurity, monitoring, endpoint management, vulnerability management, backup/recovery, SIEM/SOC, and remote access tools currently deployed across IT and OT environments?

33. Are there restrictions on active vulnerability scanning, credentialed scanning, penetration testing, or other assessment activities within SCADA/ICS/OT environments?

34. Does the Authority currently maintain standardized remote access procedures for third-party vendors supporting SCADA/ICS environments, or will approved vendors be expected to propose secure remote support methodologies as part of task-order execution?

Response: (1) Yes. (2) Yes, approved vendors may be expected to propose secure remote support methodologies as part of task-order execution.

May 27, 2026 Page 4 of 8

35. For emergency response support requiring on-site presence within four (4) hours, does the Authority anticipate this requirement primarily applying to cybersecurity incidents, operational outages, SCADA disruptions, or all service domains outlined within the RFP?

36. Can the Authority provide approximate counts for managed endpoints, servers, PLCs, SCADA nodes, or operational facilities expected to be supported under this contract?

Response: Refer to question #1

37. Are there existing cybersecurity platforms or monitoring solutions currently utilized within the Authority’s environment (e.g., SIEM, EDR, vulnerability management, MFA, backup platforms) that vendors should expect to support or integrate with?

38. Does the Authority anticipate assigning vendors by specialization area (e.g., cybersecurity, SCADA, infrastructure support), or will task orders be competed among all awarded vendors on an as-needed basis?

Response: Both

39. Will the insurance requirements outlined within Section I.11 be required prior to award, or may successful vendors provide compliant certificates of insurance during contract finalization and prior to task-order execution?

Response: Successful vendors need to provide compliant certificates of insurance during contract finalization and prior to task-order execution.

40. Does the Authority anticipate the majority of support activities being performed remotely, on-site, or through a hybrid support model, depending on task-order requirements?

Response: Depends on task-order requirements.

41. Please identify the manufacturers currently in use for (Infrastructure).

Response: Firewalls, Core and edge switches, Routers, Wireless infrastructure, SD-WAN solutions, VPN platforms, VoIP/telephony systems

42. What virtualization platforms are currently deployed (Infrastructure)?

Response: Detailed information will be disclosed if award

43. What storage platforms/manufacturers are in use (Infrastructure)?

44. Are any systems currently end-of-life or unsupported (Infrastructure)?

45. Are cloud-hosted workloads included in scope (Infrastructure)?

46. Which cloud platforms are currently utilized (Cloud & Microsoft 365 Environment)?

47. What endpoint manufacturers are standardized (Endpoint Environment)?

48. What endpoint management platforms are currently used (Endpoint Environment)?

May 27, 2026 Page 5 of 8

49. Are devices domain-joined, Azure AD joined, or hybrid joined (Endpoint Environment)?

50. Are there legacy operating systems or unsupported devices requiring support (Endpoint Environment)?

51. What identity management platforms are currently deployed (Identity & Access Mgmt.)?

52. What SIEM platforms are currently in use (SOC & Monitoring)?

53. What EDR/XDR solutions are currently deployed (SOC & Monitoring)?

54. What patch management platforms are currently utilized (Patch Mgmt. & Vulnerability Remediation)?

55. What vulnerability scanning tools are currently deployed (Patch Mgmt. & Vulnerability Remediation)?

56. Given the complexity and breadth of the environments and service areas described within this RFP, can the Authority provide an anticipated timeline for issuing responses to vendor questions?

Additionally, if responses to vendor inquiries are issued close to the proposal due date and materially impact scope clarification or proposal development, would the Authority consider extending the proposal submission deadline to allow vendors adequate time to incorporate those responses into their proposals?

Response: No, extensions will not be considered.

57. Is there a preference for hard-copy or electronic delivery for the RFP submission?

Response: No preference

58. As the Authorities are looking to partner with a panel of expert vendors, would each vendor need to re-propose work/scope/budget each year?

59. How many physical sites/locations have on-site IT/network infrastructure requiring support (Environment & Inventory)?

60. How many of each of the following are currently supported servers, physical and virtual (desktops, laptops, mobile devices) (Environment & Inventory):

61. How many active users / M365 mailboxes exist (What M365 licenses are in use including quantities)

May 27, 2026 Page 6 of 8

62. How many users / managed identities (including service accounts) are there across the organization

63. How many printers, scanners, and other peripherals are managed (Environment & Inventory)?

64. What is the current virtualization platform and storage platform (SAN/NAS make/model/capacity) (Environmental & Inventory)?

65. Are these 30 facilities located across 30 physical properties or are there multiple properties / campus(es) with multiple facilities on?

66. What are the primary vendors and models for firewalls, core/distribution switches, access switches, and wireless infrastructure (Network Infrastructure)?

67. How many sites/facilities have on-site network infrastructure that requires support (beyond the ~30 operational facilities mentioned) (Network Infrastructure)?

68. Is there a software-defined networking (SDN) or SD-WAN solution in use (Network Infrastructure)?

69. What remote access solutions are currently in place for internal users and third parties (VPN, ZTNA, etc.) (Network Infrastructure)?

70. Confirm current Microsoft 365 adoption (Microsoft 365 & Cloud Environment):

Which workloads are in use (Teams, SharePoint, OneDrive, Intune, Azure AD/Entra ID, Defender, etc.)?

71. Are you using Intune for endpoint management today (Microsoft 365 & Cloud Environment)?

If so, what percentage of endpoints are enrolled?

72. What other cloud platforms are in use (Azure, AWS, Google Cloud, or others) (Microsoft 365 & Cloud Environment)?

73. Do you have any hybrid Azure AD setup or plans to move to full Entra ID (Microsoft 365 & Cloud

74. Is purchasing/allocating of licenses managed internally or by a 3rd party ID (Microsoft 365 & Cloud

May 27, 2026 Page 7 of 8

75. Are DNS and domain managed internally or by a 3rd party ID (Microsoft 365 & Cloud

76. How many domains are owned/managed in scope ID (Microsoft 365 & Cloud Environment)?

i.e. rivanna.org, etc.?

77. Is there any 3rd party email filtering in place currently (e.g Barracuda) (Microsoft 365 & Cloud

What are the requirements, if any, to continue using your existing solution(s) vs. replacing with something equivalent/better?

78. What is the current IAM solution (Entra ID, on-prem Active Directory, hybrid, etc.) (Identity & Access Management)?

Response: Detailed information will be disclosed if award

79. Is MFA enforced organization-wide (Identity & Access Management)?

What solution is used (Microsoft Authenticator, Duo, etc.)?

80. How is third-party/vendor access currently managed (Identity & Access Management)?

81. Do you currently have a SOC (internal or outsourced) and NOC (Security Tools & Operations)?

If outsourced, who provides them and what is the scope?

82. What tools are currently used for patch management, vulnerability scanning/management, Endpoint detection & response (EDR) / SIEM, Backup & disaster recovery (e.g., Veeam, Rubrik, Azure Backup, etc.) (Security Tools & Operations):

83. How frequently are risk assessments and penetration tests currently performed and by whom (Security Tools & Operations)?

84. What are the biggest current cybersecurity challenges or recent pain points in the IT environment (Security Tools & Operations)?

85. What is the current backup solution and retention policy (Backup, DR, and Business Continuity)?

86. Do you have a documented disaster recovery plan and when was it last tested (Backup, DR, and Business Continuity)?

87. What are the Recovery Time Objective (RTO) and Recovery Point Objective (RPO) targets for critical systems (Backup, DR, and Business Continuity)?

May 27, 2026 Page 8 of 8

88. Can you describe the current IT/OT boundary architecture in more detail (number of firewalls, data diodes, unidirectional gateways, jump servers, etc.) (IT/OT Boundary & Operational Support)?

89. What change control / approval processes exist today for changes that could impact the IT/OT boundary (IT/OT Boundary & Operational Support)?

90. What are the current on-call / after-hours support expectations specifically for Core IT systems (vs.

SCADA/ICS) (IT/OT Boundary & Operational Support)?

91. What percentage of IT support is currently handled internally vs. externally (Support & Workload)?

How many internal IT personnel are currently on staff?

Response: Detailed information will be disclosed if award

92. What are the top 3–5 recurring issues or projects you expect the selected vendor(s) to assist with in the Core IT domain (Support & Workload)?

93. Are there any upcoming major IT projects (migrations, refreshes, cloud moves, etc.) in the next 12– 24 months (Support & Workload)?

94. Which specific cybersecurity frameworks or guidance does the Authority currently align with or require vendors to follow (e.g., NIST SP 800-82, NIST Cybersecurity Framework, CISA Water Sector-specific guidance, EPA, TSA, or Virginia-specific requirements) (Current Policies, Standards & Frameworks)?

Response: NIST SP 800-53, CIS Controls v8, AWWA Water Sector Cybersecurity practices, EPA/VDH (AWIA-driven), MC-ISAC/WaterISAC

****** END OF DOCUMENT ******

Very truly yours, Miranda A. Baird Procurement Coordinator Rivanna Solid Waste Authority Phone: (434) 977-2970, ext. 137