Cyber Security Operations Center (CSOC) Services

Jacksonville Electric Authority is requesting proposals for Cyber Security Operations Center services under ITN, with responses due August 31, 2026 (public opening September 1 at 2:00 PM EST), and optional pre-response meetings on August 11 (pre-NDA) and August 17 (post-NDA), both at 10:30 AM EST. JSEB participation is encouraged but optional; no hard set-aside or preference program is applied.

The scope is 24/7 monitoring, detection, response, and threat intelligence across corporate IT, cloud, and highly regulated Operational Technology infrastructure subject to NERC CIP compliance. The vendor must serve as an extension of JEA's internal security team and disclose any use of AI, machine learning, or large language models in service delivery.

Minimum qualifications require the awarded vendor's data, support team, and personnel to be based within the continental United States, and submission of two client references from the last seven years demonstrating expertise in integrated Security Operations Center and Security Information Event Management services, including real-time monitoring, alert triage, and threat containment. One reference must demonstrate expertise in a regulated sector (energy, water, or healthcare) with compliance alignment to NIST CSF, ISO 27001, or NERC CIP; the other must demonstrate proven expertise in ServiceNow and Splunk.

The contract term is three years with JEA's option to renew for two additional one-year periods. Pricing shall be firm-fixed, with unit prices fixed for the first five years, after which CPI adjustments capped at 3% annually may be requested. JEA offers optional early-payment discounts of 1% net 20 or 2% net 10.

Evaluation criteria are quotation of rates (30 points), past performance and company experience (20 points), experience and availability of professional personnel (20 points), ability to design approach and work plan (30 points), and optional presentation or demonstration (up to 30 points). Insurance must include Workers' Compensation (statutory limits), Commercial General Liability ($1 million each occurrence / $2 million annual aggregate), Automobile Liability ($1 million combined single limit), and Excess or Umbrella Liability ($1 million). Liquidated damages are capped at 10% of contract price if quality criteria are not met.