26-005 Erate - SEIM/SOC/XDR solution

Bibb County School District is issuing RFP 26-005 for a comprehensive SIEM/SOC/XDR cybersecurity solution to monitor and protect approximately 35,000 endpoints across 42 physical locations. The procurement seeks a hosted 3-year subscription service with 24/7 monitoring, threat detection, and incident response capabilities covering diverse device types including 22,000 Chromebooks, 6,000 Windows devices, 300 macOS systems, and 6,500 iOS devices. The solution must integrate with existing Microsoft Sentinel, Defender, and current infrastructure including Palo Alto firewalls, Meraki switches, and Cisco networking equipment. Evaluation will be based on 600 possible points, with 100 points for responsiveness, 50 for company overview, 300 for cost, and 150 for E-rate experience. Proposals are due on August 25, 2025, at 8 AM EST, with a contract term of one year and options for four renewals. Key technical requirements include monitoring both on-network and off-network devices, adhering to compliance frameworks like FERPA, CIPA, and NIST Cybersecurity Framework, and providing a 99.9% uptime service level agreement.

The procurement encourages participation from minority and small business enterprises, with specific evaluation point allocations favoring vendors experienced with E-rate funding processes. The district currently utilizes Microsoft 365 with A5 licensing and expects the new solution to seamlessly integrate with existing tools like Microsoft Defender, Intune, and Google Admin Console. While no predetermined budget is specified, the project will be funded through E-rate grants, with vendors responsible for ensuring full funding coverage. The current technology environment includes a mixed computing ecosystem with 98% of endpoints managed through Intune and Google Admin Console, a 14Gbps primary internet connection, and infrastructure that is 50% cloud-based. Vendors must provide US-based support, comply with SOC2 standards, and demonstrate capabilities in endpoint protection, network traffic monitoring, and potential threat detection. The district requires the vendor to handle deployment and setup, with day-to-day incident management to be handled internally but with provisions for escalation notifications and automated threat responses.