RFQ_PERS - 27006 - File System and Identity Monitoring.pdf

REQUEST FOR QUOTES (RFQ)

Best Value Analysis (BVA)

File System and Identity Monitoring

PERS-RFQ # 27006

OregonBuys # S-45900-00018346

Issue Date: November 3, 2026

Issuing Office: Public Employees Retirement Solution (PERS or Agency)

RFQ Contact

Information

(Authorized Representative): Ryan Ellis, Procurement & Contracts Specialist

Address: 11410 SW 68th Parkway

Tigard, OR 97223

Phone: (503) 603-7505

E-mail: ryan.ellis@pers.oregon.gov

Offer Due Date and Time: Tuesday, December 1, 2026, 2:00PM PST.

Service Category: File System and Identity Monitoring

Introduction

PERS is pursuing Varonis Software as a Service (“SaaS”) Solution. This RFQ is only for renewing our Varonis solution as its being migrated to being hosted in the cloud, not hosted on-premises. Offeror’s proposal must include all necessary end user licenses, modules, training, and maintenance/support agreements and costs. DAS PS anticipates the Award of one (1)

Purchase Order (“Contract”) as a result of this RFQ.

mailto:ryan.ellis@pers.oregon.gov

Agency Background Information

PERS MISSION: PERS serves the people of Oregon by administering public employee benefit trusts to pay the right person the right benefit at the right time.

PERS was established in 1946 to provide retirement, disability, and death benefits to Oregon’s state, school district, and local government employees. The Agency’s 400 employees serve approximately

228,000 non-retired members, 156,500 retired members or beneficiaries, and 900 public employers.

PERS is governed by a five-member board. PERS also administers a deferred compensation plan, known as the Oregon Savings Growth Plan (OSGP), a tax qualified 457 plan.

Scope of Work

The goal of this effort is to purchase licensing to upgrade to a cloud version of Varonis.

• Varonis Subscription – Offeror shall provide a subscription to include five hundred and one (501) users for Active Directory, five hundred and one (501) users for

Windows/NAS, and two (2) collectors.

PERS will require the following additional services:

• Maintenance and Support – Awardee shall provide maintenance and unlimited support for this product. Offeror is responsible for software maintenance and updates.

Offeror shall provide and be available to provide support during PERS operating hours:

Monday through Friday 6:00 AM to 6:00 PM PT. Response time to any support request shall be made in less than a two (2) hour window.

• Configuration and Data Migration - Awardee shall develop a data migration plan, perform initial setup, and complete configuration services. This shall include but not be limited to: data migration from an existing on-premises version of Varonis to their cloud version and any troubleshooting for all functions to be operational.

• Training - Awardee shall provide a training package for PERS staff (2 users) for product use. Acceptable training formats may include online, pre-recorded, new user training, train the trainer, and training manuals. Although most of the training requests will be from the launch of the product, the Offeror shall provide ongoing training support.

Transition Services

At PERS’s option, the awarded vendor will perform any requested transition services which may include analysis, data migration, configuration, implementation services, consulting services, and providing data to PERS in a suitable format via electronic submission. If PERS elects to include transition services, such transition services will be included via amendment.

The awarded vendor shall provide PERS with full access and possession of all created materials, data, and records that pertain to the services described in this solicitation.

Insurance Requirements

Prior to execution of the Contract, the apparent successful Offeror shall secure and demonstrate to

Agency proof of insurance coverage meeting the requirements identified in this solicitation or as otherwise negotiated. Failure to demonstrate coverage may result in Agency terminating negotiations and commencing negotiations with the next highest-ranking Offeror.

Successful Offeror shall obtain at successful Offeror’s expense the required types of insurance specified in Attachment # 6 listed in this RFQ.

Term of Service

PERS anticipates the award of one Contract from this solicitation. The initial term of the Contract is anticipated to be for a three (3) year term with optional annual renewals up to (10) ten years.

PERS reserves the right to amend additional years of service.

End of Scope of Work

Questions and Requests

All questions and requests for clarification of this RFQ must be submitted in writing by email to the above listed Authorized Representative, and must be received no later than November 24, 2026, at 2pm PST. When appropriate, as determined by the Authorized Representative in its sole discretion, revisions, substitutions, or clarification of this RFQ will be sent electronically.

RFQ Response Submittal

Responses must be received on or before the Offer Due Date and Time. All submissions must be emailed only to the Authorized Representative listed above.

PERS may extend the Offer Due Date when it is in the best interest of Agency. Agency reserves the right to reject all Offers and/or to cancel this RFQ if it is in the best interest of Agency.

Submission Requirements Checklist

➢ Include the completed Pricing Sheet (Attachment # 1).

➢ Include the completed Security Certification (Attachment # 3).

➢ Include the completed Certified Office Inclusion & Diversity Form (Attachment # 6, if applicable).

➢ Include the End User License Agreement

➢ Include any Cloud Service Agreements

➢ Include any Maintenance and Support Agreement(s)

➢ Include any onboarding forms

➢ Please note: PERS reserves the right to request references and to contact any such references for additional information relevant to the services described in this RFQ

➢ Prepare and schedule a solution demonstration with PERS. A free seven-day trial of the solution.

➢ Share the solution operating and training instructions for evaluation committee to review

➢ Share a Bio for the account representative and each proposed key person that describes relevant qualifications and experience

➢ Narrative description of Offeror’s Approach, Methodology & Proposed Timeline to implement the proposed solution

➢ Narrative describing Offeror’s organization, work experience, and relevant successful projects

Submitted Responses Subject to Disclosure as Public Records

If Offeror believes any of its Offer is exempt from disclosure under Oregon Public Records Law

(ORS 192.311 through 192.478), Offeror shall submit a fully redacted version of its Offer, clearly identified as the redacted version. If an Offeror includes information and data with its submitted

Quote that Offeror regards as proprietary, privileged, or otherwise confidential; Offeror must identify such information in a separate document submitted with its Quote and provide a redacted submission along with the original submission. Otherwise, State will assume that Offeror consents to public disclosure of the original submission.

RFQ Evaluation & Criteria

Offers will be reviewed to determine if all requirements have been met. Those meeting the requirements will be evaluated to determine the “Best Value” for the agency. “Best Value” is based solely on the evaluators’ determination of what best meets the needs of the agency, price, and other factors such as: experience, expertise, availability, and resource capacity will be considered. A maximum score of 100 points may be obtained from the following requirements.

The Best Value Analysis is planned to evaluate all proposed products that meet the business and technical requirements.

We will use the following criteria in the decision process:

• Implementation and Schedule of the proposed solution = 15 points

• Offeror’s organization, work experience, and relevant successful projects e = 15 points

• Cost = 30 points

• Solution Demonstration = 10 points

• Meets solution requirements = 30 points

Agency prefers Oregon Small Business Enterprises (OSBEs), as described in OAR 125-246-

0230. For evaluation purposes, Agency will apply an OSBE preference by increasing the score or point total of any Offer submitted by an OSBE by 10%.

Award

The Offeror with the most advantageous submission will be awarded a contract. PERS will negotiate contract terms, conditions, Statement of Work, and other agreements such as licensing, maintenance, and support with the successful Offeror.

The successful Offeror will need to register in the PERS portal for goods and services, OregonBuys. This portal is used for procurement and vendor payment as well. PERS asks that you review the link below to register:

https://oregonbuys.gov/bso/view/login/login.xhtml https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Foregonbuys.gov%2Fbso%2Fview%2Flogin%2Flogin.xhtml&data=05%7C01%7Cryan.ellis%40pers.oregon.gov%7C52515b6120704bc912cb08db5e2686ac%7C860f660b157845aa8e77aa9b68a0c0dd%7C0%7C0%7C638207291838414002%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=Dco7bAlBKpQYsHjP7zpF6VKQjiOcij0JOB0F97%2B63iA%3D&reserved=0

Protested Award

An Affected Offeror will have 7 calendar days from the date of the Intent to Award notice to file a Written protest. An Offeror is an Affected Offeror only if the Offeror would be eligible for

Contract award in the event the protest was successful and is protesting for one or more of the following reasons as specified in ORS 279B.410:

• All higher ranked Offers are non-Responsive.

• PERS has failed to conduct an evaluation of Offers in accordance with the criteria or process described in the RFQ.

• PERS abused its discretion in rejecting the protestor’s Offer as non-Responsive.

Protests must:

• Be delivered to the RFQ contact via email

• Reference the RFQ number

• Identify Offeror’s name and contact information

• Be signed by an Authorized Representative

• Specify the grounds for the protest

• Be received within 7 calendar days of the Intent to Award notice

Response to Protest. PERS will address all protests submitted in a reasonable time and will issue a Written decision to the respective Offeror. Protests that do not include the required information prescribed in this Section may not be considered by PERS.

Certification Office for Business Inclusion & Diversity (COBID) Participation

Pursuant to Oregon Revised Statute (ORS) Chapter 200, and as a matter of commitment, Agency encourages the participation of minority, women, and emerging small business enterprises in all contracting opportunities. Agency also encourages joint ventures or subcontracting with minority, women, and emerging small business enterprises. If the contract resulting from this RFQ provides subcontracting opportunities, the successful Offeror may be required to submit a completed COBID Outreach Plan prior to execution.

RFQ Attachments that follow, begin on the next page. By such reference, the following seven

(6) attachments and their respective content are incorporated into this RFQ.

➢ Attachment # 1, Pricing Sheet

➢ Attachment # 2, Security Frameworks and Controls

➢ Attachment # 3, Security Certification

➢ Attachment # 4, Information Security Policies

➢ Attachment # 5, Certified Office Inclusion & Diversity Form (if applicable)

➢ Attachment # 6, Insurance Requirements

Attachment # 1

RFQ Pricing Sheet

Offeror agrees to provide the services described in the scope of work for this RFQ, for the following sums:

File System and Identity Monitoring

Cost

Annual Cost Per User

Annual Support Cost $

RFQ Submittal prepared by:__________________________________________

Title: ____________________________________________________________

Address: _________________________________________________________

Phone #: _________________________________________________________

Email Address: ____________________________________________________

Authorized Signature:_______________________________________________

Attachment # 2

Security Frameworks and Controls

The proposed solution shall adhere to the security control requirements noted below:

• Identity access management (IAM) functionality: Single sign-on (SSO) o Proposed solution must support SSO integration using Microsoft Entra ID or alternative as specified by Agency.

o Proposed solution must provide support for MFA for Agency staff.

• Application / solution logging o Proposed solution must support integration of solution and application logs into

Agency’s SIEM platform for event monitoring.

Attachment # 3

Security Certification

Offer must contain a statement demonstrating Offeror's agreement that if awarded a Contract:

a. Offeror and Offeror's staff with access to State solutions, facilities, data, and confidential information will submit to all security checks requested by DAS or

Agency, which may include any combination of fingerprinting, Oregon Law

Enforcement Data Solutions (“LEDS”) and Federal Bureau of Investigation Criminal

Justice Information Services (“FBI CJIS”) background checks; and

b. Upon request, Offeror and Offeror’s staff will sign a non-disclosure agreement for any/all data or information received or processed on its equipment from the State of

Oregon; and

c. Offeror will protect at all times State of Oregon sensitive material; and

d. Offeror will meet or exceed the State of Oregon’s security standards as set forth in the following:

a. Privileged Access Monitoring and Reporting viewable at:

https://www.oregon.gov/das/Policies/107-004-140.pdf

b. Statewide Information Security Program Plan viewable at:

c. https://www.oregon.gov/eis/cyber-security-services/Documents/eis-css-statewide-information-security-program-plan.pdf

e. Statewide Cloud and Hosted Solutions policy:

https://www.oregon.gov/das/policies/107-004-150.pdf

f. Oregon’s Statewide Information Security Standards, found online at:

https://www.oregon.gov/eis/cyber-security-services/Pages/guidance-for-state-agencies.aspx including security controls that meet or exceed “Moderate” security controls in the National Institute of Standards and Technology (NIST) Special

Publication (SP) 800-53.

g. Oregon Statewide Information Technology Policies:

www.oregon.gov/das/Pages/policies.aspx#IT.

h. The Oregon Consumer Information Protection Act (OCIPA), ORS 646A.600 through

646A.628, to the extent applicable. For purposes of OCIPA, Offeror is a vendor.

As the vendor awarded, I certify that my company shall comply with all applicable PERS security requirements and policies as stated above and included in the Attachments:

Authorized Person: _________________________________________________

Authorized Signature: _______________________________________________ https://www.oregon.gov/das/Policies/107-004-140.pdf https://www.oregon.gov/eis/cyber-security-services/Documents/eis-css-statewide-information-security-program-plan.pdf https://www.oregon.gov/eis/cyber-security-services/Documents/eis-css-statewide-information-security-program-plan.pdf https://www.oregon.gov/das/policies/107-004-150.pdf https://www.oregon.gov/eis/cyber-security-services/Pages/guidance-for-state-agencies.aspx https://www.oregon.gov/eis/cyber-security-services/Pages/guidance-for-state-agencies.aspx http://www.oregon.gov/das/Pages/policies.aspx

Attachment # 4

PERS Information Security Requirements

In addition to the State of Oregon’s security requirements identified in attachment J, Offeror’s agreement that if awarded will also include language whereby Offeror’s information security program meets or exceeds PERS security requirements as identified below:

1. Information Security Program Requirements

Offeror shall maintain a documented, organization-wide Information Security Program aligned with industry frameworks (i.e., NIST, ISO, CIS, etc.), appropriate to the nature, sensitivity, and volume of the data processed or stored on behalf of the Agency.

The program must:

1.1. Include governance, policies, standards, and procedures aligned with the selected framework(s)

1.2. Be reviewed, updated, and approved annually by Offerors leadership.

1.3. Be proportionate to current threat conditions and industry best practices.

2. Data Protection & Handling

Offeror shall protect all Agency Data (including confidential, sensitive, regulated, and personal information) using safeguards consistent with industry framework(s) and best practices, including:

2.1. Access control: Role-based access, least privilege, MFA for administrative functions, and periodic entitlement reviews.

2.2. Encryption: Data encrypted in transit and at rest using industry-accepted algorithms.

2.3. Secure configuration & hardening: Baselines aligned to CIS Benchmarks or equivalent.

2.4. Data minimization & segregation: Limit collection, retention, and internal access to only that required to fulfill contractual obligations.

2.5. Data return, destruction, or secure transfer at contract termination following NIST SP 800-88 guidance.

3. Asset & System Management

Offeror must maintain inventories of hardware, software, cloud resources, and data flows relevant to Agency Data. Deployed security controls must include:

• Secure provisioning, configuration baselines, and vulnerability management.

• Timely application of critical patches (normally within 30 days unless otherwise justified).

• Logging and monitoring consistent with industry framework(s) like NIST CSF Detect and CIS Safeguard logging requirements.

4. Third-Party & Subprocessor Management

Offeror may not engage any subprocessors or subcontractors that access Agency Data without prior written approval of PERS CIO or ISRO . Offeror must:

4.1. Perform documented third-party risk assessments of all subprocessors.

4.2. Impose security requirements at least as strong as those in this Agreement.

4.3. Remain fully liable for all acts and omissions of approved subprocessors.

5. Security Awareness & Training

Offeror shall ensure all personnel with access to Agency Data receive:

5.1. Annual security awareness and privacy training.

5.2. Role-specific training for system administrators or developers aligned with the appropriate security framework and guidelines.

6. Vulnerability Management & Secure Development

For all systems, applications, APIs, or services used to process or store Agency Data, the offeror shall:

6.1. Conduct regular vulnerability scanning, remediation, and penetration testing.

6.2. Utilize secure SDLC practices, including code review, dependency scanning, and change control.

6.3. Track and remediate vulnerabilities in accordance with risk severity (critical/high addressed within industry-standard timelines).

7. Incident Detection, Reporting & Response

Offeror must maintain an Incident Response Plan aligned with industry frameworks and best practices, for example to NIST CSF Respond/Recover and CIS incident handling safeguards.

Requirements include:

7.1. 24/7 monitoring or alerting capability for security events impacting Agency Data.

7.2. Notification to Agency within 24 hours of confirmation of any actual or suspected security incident involving Agency Data.

7.3. Cooperation with Agency investigations, regulatory notifications, evidence preservation, and post-incident review.

8. Business Continuity & Disaster Recovery

Offeror must:

8.1. Maintain BCDR plans consistent with industry frameworks like NIST CSF Recover and CIS resiliency safeguards.

8.2. Test recovery plans at least annually.

8.3. Ensure Agency Data remains recoverable within agreed-upon Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO).

9. Audit Rights & Assessment Cooperation

Offeror agrees to:

9.1. Provide Agency (or its designated auditor) with reasonable access to relevant security documentation, policies, SOC reports, penetration test results, and other evidence necessary to validate compliance.

9.2. Cooperate with Agency-led assessments or questionnaires aligned to CIS v8.0 or

NIST CSF 2.0.

9.3. Remediate material deficiencies within mutually agreed timeframes.

10. Certifications, Attestations & Reporting

Offeror shall maintain industry-recognized certifications or assessments, when applicable, such as SOC 2, ISO 27001, FedRAMP, or similar.

Upon request, Offeror must provide:

10.1. Copies of recent security/compliance attestations.

10.2. Executive summaries of third-party assessments.

10.3. Evidence of corrective action plans and closure.

11. Compliance With Laws & Regulations

Offeror must comply with all applicable laws, regulations, and state/federal cybersecurity requirements related to Agency Data. This includes breach notification laws, privacy regulations, and any statutory controls relevant to the Agency’s jurisdiction(s).

12. Right to Terminate for Security Reasons

Agency retains the right to immediately terminate the Agreement if the offeror:

12.1. Fails to maintain required security practices,

12.2. Experiences repeated or significant security incidents, or

12.3. Refuses to remedy deficiencies identified during assessments.

Attachment # 5

Certified Office Inclusion & Diversity Form

SUBMIT THIS FORM WITH YOUR RESPONSE (IF APPLICABLE)

Contractor Information

Company Legal Name:

Federal Tax ID#:

Address:

Contact Person:

Email:

Phone:

Fax:

By signing this Cover Page, Contractor agrees to comply with all requirements, specifications and terms and conditions included with this Request for Quote (including all Attachments and Addenda, if any) and all specifications, warranties, etc. included in its submitted response. Contractor certifies, under penalty of perjury, that they are not in violation of any tax laws described in ORS 305.385(6) and (7).

Authorized Signature:

Printed Name:

Title:

Date:

Complete if Applicable:

CERTIFIED BUSINESS FIRM PARTICIPATION (ORS 200.005 to 200.075; ORS 200.160 to 200.200;

ORS 279A.105)

NOTE: This section is for information purposes only and shall not be considered in the evaluation of the bid or award of a contract.

Type of Certification Certification

Number

Certified in Oregon?

Disadvantaged Business Enterprise (DBE)

Minority Business Enterprise (MBE)

Women Business Enterprise (WBE)

Emerging Small Business (ESB)

Attachment # 6

INSURANCE REQUIREMENTS

Contractor, prior to performing under the resulting Contract, shall maintain insurance in full force and at its own expense throughout the duration of the Contract, as required by any extended reporting period or tail coverage requirements, and all warranty periods that apply.

Contractor shall obtain the following insurance from insurance companies or entities that are authorized to transact the business of insurance and issue coverage in the State of Oregon and that are acceptable to Agency. Coverage shall be primary and non-contributory with any other insurance and self-insurance, with the exception of Professional Liability and Workers’

Compensation.

Vendor shall pay for all deductibles, self-insured retention, and self-insurance, if any.

Commercial General Liability

Contractor shall obtain, at contractor’s expense, and keep in effect during the term of this contract, commercial general liability insurance covering bodily injury and property damage in a form and with coverages that are satisfactory to the state. This insurance shall include personal and advertising injury liability, products and completed operations and contractual liability coverage for the indemnity provided under this contract. Coverage shall be written on an occurrence basis in an amount to not be less than $1,000,000 per occurrence. Annual aggregate limit shall not be less than $2,000,000.

Professional Liability

Contractor shall obtain, at Contractor’s expense, and keep in effect during the term of this

Contract, Professional Liability Insurance covering any damages caused by an error, omission or any negligent acts related to the services to be provided under this contract by the Contractor and Contractor’s subcontractors, agents, officers, and employees in an amount of not less than

$1,000,000 per occurrence, incident, or claim. Annual aggregate limit shall not be less than

$2,000,000. If coverage is on a claims made basis, then either an extended reporting period of not less than 24 months shall be included in the Professional Liability insurance coverage, or the

Contractor shall maintain either tail coverage or continuous claims made liability coverage, provided the effective date of the continuous claims made coverage is on or before the effective date of this Contract, for a minimum of 24 months following the later of (i) Contractor’s completion and Agency’s acceptance of all Services required under this Contract, or, (ii)

Agency or Contractor termination of contract, or, iii) The expiration of all warranty periods provided under this Contract.

Network Security and Privacy Liability

Contractor shall provide Network Security and Privacy Liability Insurance for the duration of this Contract and for the period of time in which Contractor (or its business associates or subcontractor(s)) maintains, possesses, stores, or has access to Agency or client data, whichever is longer, with a combined single limit of not less than $1,000,000 per claim or incident. This insurance must include coverage for third party claims and for losses, thefts, unauthorized disclosures, access or use of Agency or client data (which may include, but is not limited to, Personally Identifiable Information (“PII”), Payment Card Data and Protected Health

Information (“PHI”)) in any format, including coverage for accidental loss, theft, unauthorized disclosure access or use of Agency data.

Additional Insured

All liability insurance, except for Workers’ Compensation, Professional Liability, and Network

Security and Privacy Liability, required under this Contract must include an additional insured.

Certificate(s) and Proof of Insurance

Contractor shall provide to Agency Certificate(s) of Insurance for all required insurance before delivering any Goods and performing any Services required under this Contract. The

Certificate(s) shall list the State of Oregon, its officers, employees, and agents as a Certificate holder and as an endorsed Additional Insured. The Certificate(s) shall also include all required endorsements or copies of the applicable policy language affecting coverage required by this

Contract. If excess/umbrella insurance is used to meet the minimum insurance requirement, the

Certificate of Insurance must include a list of all policies that fall under the excess/umbrella insurance. As proof of insurance Agency has the right to request copies of insurance policies and endorsements relating to the insurance requirements in this Contract.

Notice of Change or Cancellation

Contractor or its insurer must provide at least 30 days’ written notice to Agency before cancellation of, material change to, potential exhaustion of aggregate limits of, or non-renewal of the required insurance coverage(s).

Insurance Requirement Review

Contractor agrees to periodic review of insurance requirements by Agency under this Contract and to provide updated requirements as mutually agreed upon by Contractor and Agency.

State Acceptance

All insurance providers are subject to Agency acceptance. If requested by Agency, Contractor shall provide complete copies of insurance policies, endorsements, self-insurance documents and related insurance documents to Agency’s representatives responsible for verification of the insurance coverages required.