File System and Identity Monitoring

The Public Employees Retirement System (PERS) of Oregon is soliciting quotes under RFQ PERS-27006 (OregonBuys S-45900-00018346) for file system and identity monitoring services, with offers due December 1, 2026 at 2:00 p.m. PST. PERS encourages Oregon Small Business Enterprises (OSBEs) to respond and will apply a 10% score increase to OSBE submissions, but no mandatory set-aside applies.

PERS seeks to renew and migrate its Varonis software-as-a-service solution from on-premises hosting to cloud-based hosting. The scope covers subscription licenses for 501 Active Directory users, 501 Windows/NAS users, and 2 collectors, plus maintenance and support, configuration and data migration, and training for 2 PERS staff members. Support must be available during PERS operating hours (Monday through Friday, 6:00 a.m. to 6:00 p.m. PT) with response times under 2 hours. The RFQ requires security controls aligned with NIST, ISO, and CIS frameworks, covering identity access management, encryption, incident response, and business continuity and disaster recovery, along with compliance with Oregon state security standards.

Required submissions include the pricing sheet (Attachment #1), a security certification, an End User License Agreement, Cloud Service Agreements, Maintenance and Support Agreements, onboarding forms, training instructions, key personnel bios, and narrative approach and methodology. Respondents must also provide a solution demonstration with a free seven-day trial. Insurance requirements are Commercial General Liability at $1,000,000 per occurrence and $2,000,000 aggregate, Professional Liability at $1,000,000 per occurrence and $2,000,000 aggregate, and Network Security and Privacy Liability at $1,000,000 per claim.

PERS anticipates awarding one Purchase Order. The initial term is three years, with optional annual renewals up to a total of 10 years, and PERS retains the right to amend additional years of service. Evaluation uses a Best Value Analysis with a maximum of 100 points: Meets Solution Requirements (30), Cost (30), Offeror's Organization and Work Experience (15), Implementation and Schedule (15), and Solution Demonstration (10).