UMGC RFP #92340 – Managed Security Operations Center (SOC) Services – Page 1 of 34

REQUEST FOR PROPOSAL #92340

Managed Security Operations Center (SOC) Services

ISSUE DATE: October 21, 2026

SIGNIFICANT MILESTONES DATE AND TIME

Pre-Proposal Conference October 29, 2026, at 1:00pm – 2:00pm Last Day for Questions November 2, 2026, at 10:00 AM ET Technical and Price Proposals Due November 16, 2026, at 10:00 AM ET Virtual Discussion Sessions December 8 - 16, 2026 (anticipated)

NOTICE: Prospective Offerors who have received this document from a source other than the Issuing Office should immediately contact the Primary Procurement Officer and provide their name and email address in order to ensure that amendments to the Request for Proposal or other communications can be sent to them. Any Prospective Offeror who fails to provide the Issuing Office with this information assumes complete responsibility in the event that they do not receive communications from the Issuing Office prior to the closing date. It is the responsibility of the Prospective Offeror to monitor eMMA and Bid Locker for updates to advertised Solicitations.

University of Maryland Global Campus 3501 University Boulevard East Adelphi, Maryland 20783 www.umgc.edu eMaryland Marketplace Advantage (eMMA) https://emma.maryland.gov/

Bid Locker https://bidlocker.us/a/umgc/BidLocker http://www.umgc.edu/ https://emma.maryland.gov/ https://bidlocker.us/a/umgc/BidLocker

UMGC RFP #92340 – Managed Security Operations Center (SOC) Services – Page 2 of 34

KEY INFORMATION SUMMARY SHEET

Request for Proposals Security Operations Center (SOC) Services

Solicitation Number: 92340

Pre-Proposal Conference:

October 29, 2026, from 1:00 – 2:00PM (EST) via Microsoft Teams https://events.teams.microsoft.com/event/06740c87-a8a3-4930-866a- 5fd2df11e055@704ce3d6-a4bf-4e09-8516-d52840c9f7a9?source=copyLinkLegacyShareEventDialog

This is a virtual meeting; no on-site conference will be held.

Questions Due Date and Time:

November 2, 2026, at 10:00 AM ET

Technical and Price Proposal Due (Closing) Date and Time:

November 16, 2026, at 10:00 AM ET

MBE Subcontracting Goal:

An overall Minority Business Enterprise (MBE) subcontract participation goal of three percent (3%) of the total contract dollar amount, including all renewal option terms, if any, has been established for this procurement.

The dates below are for Shortlisted Offerors only

Oral Presentations December 8 – 16, 2026 (anticipated)

Contractor(s) Selection Anticipated

January 20, 2027 (anticipated)

Agreement Executed by Selected Contractor

March 1, 2027 (anticipated)

Agreement Executed by

UMGC

After BPW Approval – UMGC will not go to BPW until after the awarded Contractor signs the Agreement https://events.teams.microsoft.com/event/06740c87-a8a3-4930-866a-5fd2df11e055@704ce3d6-a4bf-4e09-8516-d52840c9f7a9?source=copyLinkLegacyShareEventDialog https://events.teams.microsoft.com/event/06740c87-a8a3-4930-866a-5fd2df11e055@704ce3d6-a4bf-4e09-8516-d52840c9f7a9?source=copyLinkLegacyShareEventDialog https://events.teams.microsoft.com/event/06740c87-a8a3-4930-866a-5fd2df11e055@704ce3d6-a4bf-4e09-8516-d52840c9f7a9?source=copyLinkLegacyShareEventDialog

UMGC RFP #92340 – Managed Security Operations Center (SOC) Services – Page 3 of 34

TABLE OF CONTENTS

KEY INFORMATION SUMMARY SHEET

TABLE OF CONTENTS

SECTION I. GENERAL INFORMATION

SECTION II. SCOPE OF WORK

ATTACHMENT A – UMGC CONTRACTOR STANDARDS

ATTACHMENT B – SERVICE LEVELS AND PERFORMANCE METRICS

SECTION III. PROCUREMENT PHASES AND EVALUATION PROCESS

ARTICLE 1. Information Required to be Submitted with the Technical Proposal

ARTICLE 2. TECHNICAL EVALUATION PROCESS

ARTICLE 3. PRICE PROPOSAL REQUIREMENTS

ARTICLE 4. FINAL EVALUATION, RANKING AND SELECTION

APPENDICES

UMGC RFP #92340 – Managed Security Operations Center (SOC) Services – Page 4 of 34

SECTION I. GENERAL INFORMATION

1. Summary.

1.1. Solicitation: The intent of this Request for Proposals (“RFP” or “Solicitation”) is to provide qualified vendors an opportunity to present their qualifications, experience, and conceptual approach to providing the scope of services in relation to the needs of the University of Maryland Global Campus (“the University” or “UMGC”). Proposals that concisely present the information requested in the order and manner requested will be considered more favorably than a Proposal (“Proposal” or “Offer”) from an Offeror of commensurate qualifications that displays a lack of organization, conciseness, or attention to detail. Prospective bidders / offerors who obtained this document from the UMGC website, e-Maryland Marketplace, or any source other than the Procurement Officer(s), should provide their names and email addresses to the Issuing Office (see below) to ensure receipt of addenda and other communications regarding this solicitation.

1.2. Procurement Regulations: This RFP shall be conducted in accordance with USM

Procurement Policies and Procedures. The procurement method is Competitive Sealed Proposals. The text of the Policies and Procedures is available at:

http://www.usmd.edu/regents/bylaws/SectionVIII/VIII300.html.

1.3. Background: Go to http://www.umgc.edu/visitors/about/ for a profile of the University.

We are proud to have had a global presence since 1949. While we offer online programs, we also offer more than 175 classroom and service locations worldwide, including many at military installations. Our locations span our Stateside location which can be accessed here: https://www.umgc.edu/locations. Our Europe locations, which can be accessed here: https://europe.umgc.edu/locations. And our Asia locations, which can be accessed here: https://asia.umgc.edu/locations. UMGC is known for our commitment to delivering a wide variety of respected online programs to working adults and military servicemembers, veterans, and their family members. We're also known for our reputation as a Maryland state university and our dedication to helping our students reach their academic and career goals. Read the UMGC Overview which can be access here: https://issuu.com/umucachiever/docs/umgc_overview_fy2025_a for an in-depth look at our culture of innovation and mission-driven service in action.

2. Issuing Office.

2.1. Issuing Office:

University of Maryland Global Campus Office of Procurement Services 3501 University Blvd. East Adelphi, MD 20783

Procurement Officers:

Alicia Klein Director – Procurement Alicia.klein@umgc.edu http://www.usmd.edu/regents/bylaws/SectionVIII/VIII300.html http://www.umgc.edu/visitors/about/ https://www.umgc.edu/locations https://europe.umgc.edu/locations https://asia.umgc.edu/locations https://issuu.com/umucachiever/docs/umgc_overview_fy2025_a mailto:Alicia.klein@umgc.edu

UMGC RFP #92340 – Managed Security Operations Center (SOC) Services – Page 5 of 34

Rosemary Williams Senior Buyer - IT rosemary.williams@umgc.edu

2.2. The Procurement Officer(s) shall be the point(s) of contact with the University for purposes of the preparation and submittal of proposals in response to this solicitation.

3. Questions and Inquiries.

3.1. All questions and inquiries regarding this procurement must be directed to the individual(s) referenced with the Issuing Office above. Inquiries will receive a written reply. Copies of replies will be sent to all other Offerors, but without identification of the inquirer. All such questions and inquiries must be received by the date and time as listed in the Key Information Summary Sheet above.

3.2. Offerors remain solely responsible for the content, accuracy, relevance, and appropriateness of all questions submitted. Questions generated through artificial intelligence (AI), automated tools, or other third-party technologies must be reviewed and validated by the Offeror prior to submission. UMGC requests that Offerors refrain from submitting generic, duplicative, speculative, or irrelevant questions that are not directly applicable to this solicitation. The submission of excessive, repetitive, or non-substantive questions may increase administrative burden and delay the procurement process for all participants. Offerors are expected to exercise professional judgment and conduct an appropriate review of the solicitation before submitting inquiries.

3.3. Questions that, in UMGC’s reasonable discretion, appear to have been generated through AI without substantive review by the Offeror, may be omitted from UMGC’s question and answer opportunities. This shall include, but not be limited to, questions already addressed within the solicitation. UMGC reserves the right to consolidate similar questions, decline to respond to questions deemed unrelated to the procurement, and determine whether a question warrants the issuance of an amendment or clarification.

4. Pre-Proposal Conference. If a Conference will be held, the date, time, and location is indicated on the Key Information Summary Sheet. Attendance at the Conference is not mandatory, but all interested parties are encouraged to attend in order to facilitate better preparation of their Proposals. Offerors shall submit their top three (3) questions in writing to the Procurement Officers prior to the pre-proposal conference. All potential Offerors should register using the link in the Key Information Summary Sheet. Attendees that do not submit a Please try to register at least 48 hours in advance. Appropriate auxiliary aids and services for qualified individuals with disabilities will be provided upon request. Contact the Procurement Officer(s) with specific requests at least five (5) business days prior to meeting.

MBE subcontractors are encouraged to attend the Conference to market their participation to potential prime contractors.

5. Proposal Closing Date/Due Date and Time.

5.1. Technical Proposal: Technical Proposals must be uploaded electronically at the UMGC Bid Locker link provided below no later than the date and time indicated in mailto:rosemary.williams@umgc.edu

UMGC RFP #92340 – Managed Security Operations Center (SOC) Services – Page 6 of 34 the Solicitation Schedule. File names for the Technical Proposal documents are to include the RFP number and the Proposer’s name. NO PRICING INFORMATION is to be provided in the Technical Proposal.

Bid Locker link for Technical Proposal upload:

https://bidlocker.us/details/6605_Rfp_92340___Managed_Security_Operations_Center_Soc_S ervices

Proposers must be registered on Bid Locker prior to uploading proposals. To register for a Bid Locker account, go to:

https://bidlocker.us/Account/Signup/UMGC.

Should you encounter any issues during account set-up or require additional assistance with Bid Locker, please reach out to Bid Locker directly at help@bidlocker.us or 267-225-1407. (*DO NOT wait until the due date for Proposals to sign up for an account; sign up as soon as possible.)

The University advises Proposers to allocate an adequate amount of time to create a Bid Locker account prior to any submission due date. It is also advisable to familiarize yourself with the Bid Locker site and the upload features and functionality related to uploading documents.

Proposers shall allow sufficient time in uploading the Technical Proposal to ensure timely receipt by the Issuing Office via the Bid Locker site. Upon successful submission, Proposers may download a submission receipt on Bid Locker.

Proposers will also receive an email confirmation within a few minutes from Bid Locker. Proposers that do not receive confirmation should immediately notify the Issuing Office, and contact Bid Locker at help@bidlocker.us or 267-225-1407 to confirm that their Proposal has been received. Proposers will not be able to upload Proposals after the due date and time, and late Proposals will not be considered.

If any pricing information is included in the Technical Proposal, the Proposal may be deemed non-responsive by the Issuing Office. Hyperlinks to software products that indicate that the Technical Proposal is posted by the Proposer on an electronic site may be rejected or be considered non-responsive if a “Click-Through Agreement” is required to be accepted by UMGC in order to download the Technical Proposal.

By providing the Technical Proposal electronically to UMGC, the Proposer grants UMGC an unlimited right to generate additional electronic and/or paper copies for distribution solely for the purpose of evaluation and review.

5.2. Price Proposal: Price Proposals must be uploaded electronically at the UMGC Bid

Locker link provided below no later than the date and time indicated in the Solicitation Schedule. File names for the documents are to include the RFP number and the Proposer’s name.

https://bidlocker.us/details/6605_Rfp_92340___Managed_Security_Operations_Center_Soc_Services https://bidlocker.us/details/6605_Rfp_92340___Managed_Security_Operations_Center_Soc_Services https://bidlocker.us/Account/Signup/UMGC mailto:help@bidlocker.us mailto:help@bidlocker.us

UMGC RFP #92340 – Managed Security Operations Center (SOC) Services – Page 7 of 34

Refer to Section III Article 3 for more information regarding Price Proposals.

Bid Locker link for Price Proposal upload:

https://bidlocker.us/details/6605_Rfp_92340___Managed_Security_Operations_Center_Soc_S ervices

5.3. Proposals should be provided in accordance with the Solicitation Schedule. Late

Proposal submissions will not be accepted.

5.4. Neither Technical nor Price Proposals will be opened publicly. The identity of Offerors will not be disclosed prior to the Contract Award.

5.5. The Technical Proposal and/or Price Proposal, either individually or collectively, is considered by UMGC to be an Offer.

6. Minority Business Enterprises.

6.1. Minority participation is important to UMGC and the State of Maryland. State-certified

Minority Business Enterprises (MBE) are strongly encouraged to respond to this solicitation notice and to attend the Pre-Proposal Conference. If not certified by the Maryland Department of Social and Economic Mobility (DOSEM), MBEs are encouraged to initiate certification as soon as possible. For more information on the State’s MBE program or questions related to certification, please contact DOSEM’s Office of Minority Business Enterprise/Equal Opportunity, telephone 800-544-6055 or view the DOSEM website: https://marylandmdbe.gob2g.com/?TN=marylandmdbe.

6.2. An MBE subcontracting goal of no less than three percent (3%) of the total overall contract value is established for this solicitation. Proposers are expected to meet or exceed this goal. This subcontracting goal will become part of the contract. It is imperative that awarded firms follow the MBE guidelines for subcontracting requirements. If an MBE Prime Contractor is awarded the contract, this MBE subcontracting goal will still apply.

6.3. Complete and sign the MBE Utilization and Fair Solicitation Affidavit & MBE Participation Schedule Form which can be accessed at this link:

https://content.govdelivery.com/attachments/MDDGS/2026/09/01/file_attachments/3766 548/Attachment%20D-1A%20-%20Effective%209-1-26%20-%20Compressed.pdf and include it with the Technical Proposal. This form is labeled as Attachment D-1A. The information on the form may not be submitted in another format.

PLEASE CONTACT THE UMGC MBE LIAISON, pamela.welzenbach@umgc.edu, IF YOU

HAVE ANY QUESTIONS REGARDING COMPLETION OF THE ATTACHMENT D-1A

PARTS 1, 2 AND 3 FORMS.

6.4. Liquidated Damages Provision Related to MBE Goal. The Contract resulting from this solicitation requires the Contractor to make good faith efforts to comply with the Minority Business Enterprise (“MBE”) Program and Contract provisions. The State and the Contractor acknowledge and agree that the State will incur damages, including but not limited to loss of goodwill, detrimental impact on economic development, and https://bidlocker.us/details/6605_Rfp_92340___Managed_Security_Operations_Center_Soc_Services https://bidlocker.us/details/6605_Rfp_92340___Managed_Security_Operations_Center_Soc_Services https://marylandmdbe.gob2g.com/?TN=marylandmdbe https://content.govdelivery.com/attachments/MDDGS/2026/09/01/file_attachments/3766548/Attachment%20D-1A%20-%20Effective%209-1-26%20-%20Compressed.pdf https://content.govdelivery.com/attachments/MDDGS/2026/09/01/file_attachments/3766548/Attachment%20D-1A%20-%20Effective%209-1-26%20-%20Compressed.pdf mailto:pamela.welzenbach@umgc.edu

UMGC RFP #92340 – Managed Security Operations Center (SOC) Services – Page 8 of 34 diversion of internal staff resources, if the Contractor does not make good faith efforts to comply with the requirements of the MBE Program and MBE contract provisions. The parties further acknowledge and agree that the damages the State might reasonably be anticipated to accrue as a result of such lack of compliance are difficult to ascertain with precision.

6.5. Therefore, upon a determination by the State that the Contractor failed to make good faith efforts to comply with one or more of the specified MBE Program requirements or contract provisions, the Contractor agrees to pay liquidated damages to the State at the rates set forth below. The Contractor expressly agrees that the State may withhold payment on any invoices as a set-off against liquidated damages owed. The Contractor further agrees that for each specified violation, the agreed upon liquidated damages are reasonably proximate to the loss the State is anticipated to incur as a result of such violation. Notwithstanding the use of liquidated damages, the State reserves the right to terminate the Contract and exercise all other rights and remedies provided in the contract or by law.

6.5.1. Failure to submit each monthly payment report in full compliance with COMAR 21.11.03.13B(3): $25.00 per day until the monthly report is submitted as required.

6.5.2. Failure to include in its agreements with MBE subcontractors a provision requiring submission of payment reports in full compliance with COMAR 21.11.03.13B(4): $100 per MBE subcontractor.

6.5.3. Failure to comply with COMAR 21.11.03.12 in terminating, canceling, or changing the scope of work/value of a contract with an MBE subcontractor and/or amendment of the MBE participation schedule: the difference between the dollar value of the MBE participation commitment on the MBE participation schedule for that specific MBE firm and the dollar value of the work performed by that MBE firm for the contract.

6.5.4. Failure to meet the Contractor’s total MBE participation goal and the subgoal commitments: the difference between the dollar value of the total MBE participation commitment on the MBE participation schedule and the MBE participation actually achieved.

6.5.5. Failure to promptly pay all undisputed amounts to an MBE subcontractor in full compliance with the prompt payment provisions of this contract: $100 per day until the undisputed amount due to the MBE subcontractor is paid.

7. Signing of Forms. A Proposal, if submitted by an individual, shall be signed by the individual. If submitted by a partnership, a Proposal shall be signed by such member(s) of the partnership with authority to bind the partnership. If submitted by a corporation, a Proposal shall be signed by an officer and attested by the corporate secretary or an assistant corporate secretary; if not signed by an officer, there must be attached a copy of a board resolution or that portion of the by-laws, duly certified by the corporate secretary, showing the authority of the person so signing on behalf of the corporation.

8. Acceptance of Terms and Conditions. By submitting a Proposal, an Offeror shall be deemed to have accepted the terms, conditions, and requirements set forth

UMGC RFP #92340 – Managed Security Operations Center (SOC) Services – Page 9 of 34 in this RFP. The RFP including all addenda in total shall be incorporated into the Contract by reference.

9. Contractual Agreement and Term.

9.1. The University intends to award one (1) contract with a single, qualified Offeror as a result of this Solicitation.

9.2. The contract to be entered into as a result of this RFP shall be by and between the Offeror as Vendor/Contractor and UMGC in the form of a University Contract and shall contain the mandatory provisions included in Appendix C as well as any additional terms required by UMGC or the State of Maryland. Exceptions, if any, must be clearly identified in the transmittal letter enclosed with the technical proposal. As deemed in the best interest of the University, mutually agreeable modifications of the solicitation provisions, if allowed by law, will be documented by express identification in the final contract as superseding the pertinent provisions of the solicitation.

9.3. The initial term of any contract arising from this RFP action shall commence on the date the contract is executed on behalf of UMGC, or such other date as UMGC and the Contractor shall agree. It is anticipated that the award will be subject to the approval of the State of Maryland Board of Public Works and may be subject to the approval of the USM Board of Regents. Upon receipt of all required approvals, the University will execute the Contract with the awarded Contractor.

9.4. The contract shall be in effect for an initial term of three (3) years, unless otherwise extended, expired, or terminated pursuant to the Contract. There are two (2), one-year renewal options at UMGC’s sole option.

9.5. Maximum Contract Value: The aggregate value of all Services provided under the Contract shall not exceed the amount approved by the USM Board of Regents and/or Maryland Board of Public Works.

10. Confidentiality of Offeror’s Information. Refer to Appendix S for the terms of confidentiality of UMGC’s and Offeror’s information.

11. Post-Award Confidentiality. Refer to Appendix C-1 for the confidentiality obligations of awardee and UMGC.

12. Insurance Requirements. The Contractor must maintain, at a minimum, the insurance coverages outlined below, or any minimum requirements established by law if higher, for the duration of the Contract, including option periods, if exercised. The following type(s) of insurance and minimum amount(s) of coverage are required:

12.1. Commercial General Liability - One million dollars ($1,000,000) combined single limit per occurrence for bodily injury, property damage, and personal and advertising injury and three million dollars ($3,000,000) annual aggregate. The minimum limits required herein may be satisfied through any combination of primary and umbrella/excess liability policies.

12.2. Cyber Security/Data Breach Insurance – Five million dollars ($5,000,000) per occurrence. The coverage must be valid at all locations where work is performed or

UMGC RFP #92340 – Managed Security Operations Center (SOC) Services – Page 10 of 34 data or other information concerning the University’s claimants or employers is processed or stored.

12.3. Worker’s Compensation - The Contractor shall maintain such insurance as necessary or as required under Workers’ Compensation Acts, the Longshore and Harbor Workers’ Compensation Act, and the Federal Employers’ Liability Act, to not be less than one million dollars ($1,000,000) per occurrence (unless a state’s law requires a greater amount of coverage). Coverage must be valid in all states where work is performed.

(End Section I. General Information)

UMGC RFP #92340 – Managed Security Operations Center (SOC) Services – Page 11 of 34

SECTION II. SCOPE OF WORK

1. Purpose. This Scope of Work defines the scope, responsibilities, deliverables, service levels, and operational requirements for the provision of Managed Security Operations Center (SOC) services by a Managed Security Services Provider (MSSP) for the University of Maryland Global Campus (UMGC). Go to http://www.umgc.edu/visitors/about/ for a profile of the University. We are proud to have had a global presence since 1949. While we offer online programs, we also offer more than 175 classroom and service locations worldwide, including many at military installations. Our locations span our Stateside location which can be accessed here: https://www.umgc.edu/locations. Our Europe locations, which can be accessed here: https://europe.umgc.edu/locations. And our Asia locations, which can be accessed here: https://asia.umgc.edu/locations. UMGC is known for our commitment to delivering a wide variety of respected online programs to working adults and military servicemembers, veterans, and their family members. We're also known for our reputation as a Maryland state university and our dedication to helping our students reach their academic and career goals. Read the UMGC Overview which can be accessed here:

https://issuu.com/umucachiever/docs/umgc_overview_fy2025_a for an in-depth look at our culture of innovation and mission-driven service in action.

The term “Contractor” or “MSSP” used throughout the scope of work refers to the awarded firm. The term “Contract” used throughout the scope of work refers to the anticipated contract issued to the awarded firm.

The MSSP will support and advance the maturity of the University's cybersecurity operations through continuous security monitoring, threat detection and analysis, incident response support, reporting, and strategic security advisory services. These services are intended to enhance UMGC's operational security capabilities while maximizing the value of existing security technologies and investments within the University's environment.

Through this engagement, the MSSP will help reduce cyber risk, strengthen the protection of sensitive institutional data, and support compliance with applicable higher education regulatory and security requirements.

These services aim to reduce cyber risk, protect sensitive student, faculty, research, and administrative data while supporting compliance with higher regulatory obligations such as University System of Maryland (USM) IT Security Standards, NIST Cybersecurity Framework (CSF), NIST SP 800-171, FERPA, GLBA, PCI DSS, CMMC, and NIST frameworks.

The Contract requires one (1) designated Key Personnel position: Service Operations Manager. The proposed Service Operations Manager may be based within the United States or at a nearshore location. Nearshore means a location outside the United States that is located within the Western Hemisphere and operates in a time zone that substantially overlaps with U.S. Eastern Time business hours.

2. Current State. The threat landscape is evolving at a rapid rate with the advent of Artificial Intelligence (AI). Bad actors are now capable of creating malicious packages and brute-force login attempts targeting employee and student accounts at a much higher rate than previously seen. In the last quarter, the number of security alerts in our Microsoft environments doubled. A delay in the identification of and response to an incident could http://www.umgc.edu/visitors/about/ https://www.umgc.edu/locations https://europe.umgc.edu/locations https://asia.umgc.edu/locations https://issuu.com/umucachiever/docs/umgc_overview_fy2025_a

UMGC RFP #92340 – Managed Security Operations Center (SOC) Services – Page 12 of 34 potentially increase the impact above acceptable levels. As the vulnerability and threat landscape evolves, The University has identified the need to augment current security operations tasks to enhance the ability to identify, triage, and address potential incidents in an accelerated fashion.

Currently, cybersecurity incident response at UMGC is managed by the Security Operations team, which is responsible for a broad range of operational and strategic initiatives, including security monitoring, alert triage, incident investigation, and response activities. As part of its ongoing cybersecurity program development, UMGC is actively maturing its incident response capabilities to enhance the organization's ability to detect, analyze, and respond to security incidents in a timely and effective manner.

Key initiatives supporting this effort include expanding Security Information and Event Management (SIEM) coverage, developing and refining detection policies and use cases, creating and maintaining incident response playbooks, and implementing automation to improve operational efficiency and consistency. These efforts are focused on reducing Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) while ensuring that incidents are managed, documented, and resolved in accordance with established processes and best practices.

To further strengthen its security posture, UMGC requires a managed Security Operations Center (SOC) capability that delivers specialized cybersecurity expertise and continuous 24x7 monitoring and response services. The SOC provides support and execution of incident response and management and will escalate issues to UMGC for awareness and decision making. This approach enables UMGC to maintain comprehensive security operations coverage while avoiding the significant staffing and operational costs associated with building and maintaining a fully internal SOC.

3. Scope of Services.

3.1. Security Operation Services (SOC). The MSSP will deliver end-to-end SOC services including:

3.1.1. 24x7x365 monitoring and analysis of security events using the University’s approved security monitoring platforms and telemetry sources.

3.1.2. cybersecurity incident detection, triage, escalation, containment, and response coordination.

3.1.3. improvement of the maturity, consistency, and execution of the University's incident response program.

3.1.4. optimization and definition of use cases and policies within the existing SIEM platform.

3.1.5. services that integrate with the University's current security ecosystem, minimizing disruption and maximizing operational efficiency.

3.1.6. delivery of actionable security reporting, metrics, and insights aligned with the

University's risk management objectives, compliance requirements, and operational decision-making needs.

3.1.7. a Service Operations Manager as the primary point of contact and operational escalation point. This role is considered Key Personnel as defined in the Contract in Appendix C.

3.1.8. clearly defined reporting structures, documented roles and responsibilities, and performance expectations for all assigned personnel.

UMGC RFP #92340 – Managed Security Operations Center (SOC) Services – Page 13 of 34

3.2. As-Needed Services and One-Time Projects. The University may, at its sole discretion, request additional cybersecurity services beyond the routine managed SOC services described above. The Contractor may make qualified cybersecurity personnel available to perform such services upon request and subject to mutually agreed work assignments. The University does not guarantee any minimum utilization of services under this section. Work performed under this section shall be authorized by the University and compensated in accordance with the rates established under the Contract. Unless otherwise authorized in writing by the University, work performed under this section shall be conducted on a time-and-materials basis using the rates established in the Contract.

4. Service Expectations. This section describes the detailed activities expected as part of the routine SOC services:

4.1. Security Monitoring & Detection.

4.1.1. Continuous monitoring and analysis of security events, logs, and telemetry generated across the University's SIEM tool.

4.1.2. The identification, triage, and analysis of potential security incidents, while minimizing false positives.

4.1.3. Correlation and analysis of security events across academic, administrative, cloud, and enterprise systems to identify suspicious activity and emerging threats.

4.1.4. Development, tuning, and maintenance of detection use cases, analytics, and alerting rules to improve detection effectiveness and align with the evolving higher education threat landscape.

4.1.5. Escalation of validated incidents in accordance with approved incident response procedures and service level requirements.

4.1.6. Annual review and update of SOC Operations Runbook, including incident handling procedures, notification requirements, and escalation workflows.

4.1.7. Maintenance of Incident Severity and Escalation Matrix defining roles, notification timelines, and escalation criteria.

4.1.8. Documentation updates reflecting operational, process, and technology changes.

4.2. Incident Response Process Maturation.

4.2.1. Review and enhancement of incident response procedures, escalation matrix, and response playbooks.

4.2.2. Development and refinement of incident classification criteria, prioritization methodologies, and severity definitions tailored to academic environments.

4.2.3. Implementation and optimization of automated detection, investigation, and response capabilities within SIEM.

4.2.4. Recommendations and process improvements designed to reduce Mean Time to

Detect (MTTD), Mean Time to Acknowledge (MTTA), and Mean Time to Respond

(MTTR).

4.2.5. Facilitation of quarterly incident response tabletop exercises and after-action reviews with the UMGC Security Operations (SecOps).

4.2.6. Alignment of policies and procedures with applicable industry standards and recognized cybersecurity frameworks, such as NIST 800-61r2.

4.2.7. Annual review and update of Incident Response Plan, including recommendations for process improvements and alignment with applicable cybersecurity frameworks and University requirements.

4.2.8. Maintenance and enhancement of Incident Response Playbooks for common security event and incident scenarios.

UMGC RFP #92340 – Managed Security Operations Center (SOC) Services – Page 14 of 34

4.2.9. Documentation of automation workflows and operational procedures, where applicable.

4.3. Tooling & Integration.

4.3.1. Utilization of approved security platforms, including SIEM, Endpoint Detection and Response (EDR), Intrusion Detection/Prevention Systems (IDS/IPS), Data Loss Prevention (DLP), Network and Perimeter Security, vulnerability management tools, and related security technologies. Specific platforms will be shared with the awarded Contractor.

4.3.2. Support for onboarding and integration of new log sources, systems, and applications to improve security visibility and monitoring coverage.

4.3.3. Identification and implementation of tuning recommendations to improve detection quality, reduce alert fatigue, and increase operational efficiency.

4.3.4. Maintenance of baselines and runbooks.

4.3.5. Recommendations for enhancements to security telemetry, monitoring coverage, and tool utilization.

4.3.6. Maintain existing UMGC SIEM Detection Catalog, including approved use cases and alert logic.

4.3.7. Documentation of newly developed or enhanced detection rules, correlation logic, and monitoring coverage improvements.

4.3.8. Quarterly recommendations for tuning and optimization of security monitoring capabilities.

4.4. Threat Intelligence & Proactive Defense.

4.4.1. Integration of threat intelligence, relevant to higher education (e.g., ransomware, financial aid, research theft) into monitoring, detection, and investigation activities.

4.4.2. Analysis and contextualization of threats impacting higher education institutions, including threats targeting academic operations, research environments, financial systems, and user accounts.

4.4.3. Proactive threat hunting activities based on indicators of compromise (IOCs), threat actor tactics, techniques, and procedures (TTPs), and observed attack trends, relevant to higher education institutions.

4.4.4. Recommendations to strengthen the University's security posture based on identified threats, vulnerabilities, and operational observations.

4.5. Reporting & Metrics. Expected reporting, cadence, and contents (at a minimum) are listed below:

Cadence/Report Name Contents (at a minimum) Operational Reporting Dashboard – Real-time operational dashboard available for UMGC personnel to view daily.

Summary of security monitoring activities.

Security investigations and incident activity.

Notable threats, vulnerabilities, and observed trends.

Open incidents and ongoing response activities.

Monthly Service Report Security event and alert volumes.

Incident volumes, categories, and trends.

Mean Time to Detect (MTTD) and other agreed-upon service metrics (see Attachment B).

UMGC RFP #92340 – Managed Security Operations Center (SOC) Services – Page 15 of 34

Service-level performance results.

False positive rates and detection tuning activities.

Incident escalation performance.

Key operational activities completed during the reporting period.

Recommendations for service improvements and operational enhancements.

Quarterly Executive Report Trend analysis and significant observations.

Security risk themes and threat landscape updates.

Root cause and incident trend analysis.

Service-level performance and KPI summaries.

Significant accomplishments and operational improvements.

Strategic recommendations for enhancing detection, response, governance, and overall security operations maturity.

Quarterly Threat Intelligence Report Highlight emerging threats, vulnerabilities, adversary tactics, and trends relevant to higher education institutions.

Major Incident Report (report as occurs) Incident timelines, actions taken, findings, containment activities, remediation efforts, and resolution outcomes.

Post-Incident Report (report as occurs) Lessons-learned and recommendations for significant security incidents, including opportunities for process, technology, and operational improvements.

4.6. Governance & Communication.

4.6.1. Participation in weekly operational meetings and quarterly strategic reporting.

4.6.2. Alignment of service delivery with applicable University policies, contractual requirements, and relevant cybersecurity and regulatory frameworks, including NIST Cybersecurity Framework (CSF), NIST SP 800-171, FERPA, and GLBA, as applicable.

4.6.3. Maintenance of documented communication and escalation procedures.

4.6.4. Timely escalation and notification of security incidents in accordance with approved severity matrix and service level requirements.

4.7. MSSP Responsibilities. The MSSP shall be responsible for delivering the services defined in this Statement of Work, including the operation and management of agreed-upon security monitoring, threat detection, incident response support, reporting, and advisory services. The MSSP shall provide qualified personnel, maintain effective communication with UMGC stakeholders, and perform all services in accordance with

UMGC RFP #92340 – Managed Security Operations Center (SOC) Services – Page 16 of 34 established service levels, governance requirements, and documented operational procedures.

4.8. UMGC Responsibilities. UMGC shall provide the MSSP with the access, information, and resources reasonably required to perform the services outlined in this Statement of Work. UMGC shall maintain ownership of its systems, security tools, and data; provide timely decisions and approvals; and engage appropriate stakeholders to support incident response, remediation activities, governance processes, and service reviews.

4.9. Shared Responsibilities. UMGC and the MSSP shall collaborate to maintain effective security operations through regular communication, coordinated incident management, continuous service improvement, and periodic review of operational procedures, performance metrics, and security objectives.

5. Transition (Contract End). The Contractor shall be responsible for ensuring a seamless transition of services at the conclusion of the Contract. At a minimum, the Contractor’s transition responsibilities shall include:

5.1. Develop and Submit a Transition-Out Plan. Submit a comprehensive plan for transferring services and knowledge to UMGC and/or the incoming provider. Upon contract conclusion, it is not anticipated that the Contractor will need to return any UMGC data or assets, as UMGC data remains within UMGC’s systems and physical assets such as computers, monitors, and headsets belong to the Contractor however;

the Contractor will certify in writing that no Contractor personnel retain access or confidential information upon contract termination. The Contractor must ensure all access is securely disabled as directed by UMGC.

5.2. Knowledge and Documentation Transfer. Facilitate knowledge transfer sessions, provide all relevant documentation, and respond to questions from UMGC and/or the incoming provider. Handover all Contractor-created documentation, reports, or training materials relevant to ongoing operations.

5.3. Access Termination. UMGC will initiate and execute the technical removal or disabling of user accounts, credentials, and permissions in UMGC systems. Contractor is responsible for: providing a complete list of all personnel (and any third parties) who have been given access to UMGC systems, confirming that all credentials are disabled, acknowledging in writing that their staff no longer require access and have not retained any confidential information, and assist UMGC by promptly reporting any issues or anomalies during the access termination process.

5.4. Availability of Key Personnel. Ensure Key Personnel are available for a defined transition period not to exceed thirty (30) business days after Contract conclusion to support handover activities.

5.5. Final Transition Reporting. Submit a final report summarizing all transition activities, outstanding issues, and recommendations for ongoing service delivery.

6. Implementation Success Criteria. The implementation phase shall be considered complete when the Contractor:

UMGC RFP #92340 – Managed Security Operations Center (SOC) Services – Page 17 of 34

6.1. Completes all onboarding activities identified in the approved project plan;

6.2. Successfully integrates and validates all agreed-upon monitoring, logging, escalation, and communication capabilities;

6.3. Provides all required onboarding-related documentation and artifacts;

6.4. Demonstrates operational readiness to deliver the Services in accordance with this

Statement of Work.

7. Minimum Qualifications: To be reasonably susceptible of being selected for award, an Offeror must meet the following minimum qualifications as of the Technical Proposal due date. Experience of subcontractors, affiliates, parent companies, technology partners, or other third parties will not be considered when determining whether the Offeror satisfies minimum qualification requirements. Failure to demonstrate compliance with the minimum qualifications may result in the Technical Proposal being determined not reasonably susceptible for award.

7.1. The Offeror must have a current ISO/IEC 27001 certification issued by an accredited certification body OR a current SOC 2 Type II attestation applicable to the services proposed under this solicitation. The Offeror must submit documentation as further described in Section III. Article 1, demonstrating compliance with this requirement.

7.2. The Offeror must submit the required references, as further described in Section III.

Article 1.

7.3. The Offeror must submit the required case studies. as further described in Section III.

Article 1.

8. Attachments. The following attachments are incorporated into and form a part of this solicitation. Offerors should review the attachments and provide any required information identified in the Technical Proposal Requirements section.

8.1. Attachment A – UMGC Contractor Standards. This attachment communicates UMGC’s required and preferred standards applicable to the proposed solution and services.

8.2. Attachment B – Service Level Expectations. This attachment identifies UMGC's required and preferred service-level expectations.

(balance of page left intentionally blank)

UMGC RFP #92340 – Managed Security Operations Center (SOC) Services – Page 18 of 34

ATTACHMENT A – UMGC CONTRACTOR STANDARDS

1. Performance Standards. The Contractor shall ensure continuity of services through appropriate resource planning, knowledge transfer, document maintenance, and transition support when personnel changes occur. Any staffing transitions (excluding Key Personnel) shall be managed in a manner that minimizes operational disruption and preserves institutional knowledge. Following transition to steady-state operations, Contractor performance shall be evaluated based on compliance with the Service Levels, Operational Performance Metrics, reporting requirements, and other obligations set forth in the Contract.

2. Project Management Standards. UMGC utilizes Microsoft 365 tools, including SharePoint, for project documentation and collaboration, and primarily uses Smartsheet for project management and reporting. The Contractor shall work within UMGC’s Smartsheet environment (if applicable).

3. Artificial Intelligence (“AI”) Preferred Standards. UMGC prefers solutions that utilize AI in a responsible, transparent, and educationally appropriate manner.

3.1. AI capabilities should support the delivery of reliable, accurate, and instructionally appropriate outputs that align with defined learning objectives, skills frameworks, competencies, and program outcomes. AI-enabled functions should minimize material errors and provide outputs that are relevant to the learner's context and intended use.

3.2. Where AI is used in content development, maintenance, or updates, the solution should ensure that appropriate controls and review processes are in place to maintain quality, accuracy, alignment, and accessibility. UMGC prefers solutions that incorporate human oversight and validation of AI-generated or AI-assisted content and that maintain alignment with accessibility, instructional, and quality standards throughout the content lifecycle.

3.3. AI capabilities should operate in a manner that is predictable, explainable at a functional level, and appropriate for use in an educational environment.

4. Security & Compliance Requirements. Contractor shall:

4.1. Maintain compliance with all applicable institutional policies and regulatory requirements, including, but not limited to, the Family Educational Rights and Privacy Act (FERPA), Gramm-Leach-Bliley Act (GLBA), Payment Card Industry Data Security Standard (PCI DSS), and other relevant industry or legal obligations applicable to UMGC’s environment.

4.2. Conduct all security monitoring, incident response, threat detection, and related SOC activities in alignment with recognized cybersecurity frameworks and guidance, including the NIST Cybersecurity Framework (CSF), NIST Special Publication 800-53 (Security and Privacy Controls for Information Systems and Organizations), and NIST Special Publication 800-61 (Computer Security Incident Handling Guide).

4.3. Implement and maintain secure communications, access controls, and administrative processes designed to protect UMGC systems and data. Access to UMGC environments shall be granted on the least privilege basis and limited to authorized Contractor personnel with a documented business need.

UMGC RFP #92340 – Managed Security Operations Center (SOC) Services – Page 19 of 34

4.4. Establish and maintain appropriate safeguards to ensure the confidentiality, integrity, and availability of UMGC information and systems throughout the duration of the engagement.

4.5. Promptly notify UMGC of any security events, incidents, or compliance concerns that may impact UMGC systems, data, or regulatory obligations, in accordance with established escalation procedures and service level requirements.

UMGC RFP #92340 – Managed Security Operations Center (SOC) Services – Page 20 of 34

ATTACHMENT B – SERVICE LEVELS AND PERFORMANCE METRICS

1. Incident Priority Definitions.

1.1. “Critical Severity” or “Sev 1” shall mean an active compromise of critical systems, widespread impact, regulatory risk, and/or business outage. Example incidents:

Ransomware outbreak, domain admin compromise, active data exfiltration, breach of production environment.

1.2. “High Severity” or “Sev 2” shall mean a confirmed malicious activity affecting important systems but contained. Example incidents: Privileged account compromise, malware on production server, critical vulnerability being actively exploited.

1.3. “Medium Severity” or “Sev 3” shall mean a suspicious activity requiring investigation, limited business impact. Example incidents: Repeated failed login attempts, phishing clicks without compromise, malware quarantined by EDR.

1.4. “Low Severity” or “Sev 4” shall mean informational events or low-risk anomalies.

Example incidents: Single failed login, vulnerability scan detection, policy violations.

1.5. “Informational” or “Sev 5” shall mean an event with no immediate risk. Example incidents: system alerts, routine monitoring, notifications, audit events.

2. Incident Response Times and Escalation Expectations. UMGC’s desired incident response times and escalation expectations are as follows.

For purposes of this section “Mean Time to Detect (MTTD)” means the time elapsed between the occurrence of a security event and its detection by the SOC.; “Mean Time to Respond (MTTR)” means time required to initiate response and containment activities following the identification of a security incident.

Severity Level Mean Time to Detect (MTTD)

Mean Time to Respond (MTTR) Escalation

Critical Fifteen (15) minutes Fifteen (15) minutes

Immediate executive and incident response escalation

High Thirty (30) minutes One (1) hour

SOC Manager, Security Lead, IT Operations

Medium One (1) hour Four (4) hours Security Operations Team

Low Four (4) hours One (1) business day Ticket creation only

Informational Next business day Not applicable Logging/reporting only

3. Operational Performance Metrics.

Metric Target Definition

UMGC RFP #92340 – Managed Security Operations Center (SOC) Services – Page 21 of 34

Mean Time to Detect (MTTD) ≤ 90% Percentage of security incidents detected within the MTTD response per severity level

Mean Time to Respond

(MTTR)

≤ 90% Percentage of security incidents detected within the MTTR response time per severity level

False Positive Rate < 10% Percentage of alerts investigated and determined not to represent a legitimate security threat or incident.

Reporting Timeliness 100% Percentage of required operational, incident, management, and executive reports within agreed-upon…