Managed Cybersecurity Services

The Rockwood School District in St. Louis County, Missouri is issuing a Request for Proposal (RFP) for comprehensive managed cybersecurity services to support approximately 19,000 students across multiple school campuses. The solicitation seeks qualified vendors to provide three primary service components: Managed Endpoint Detection and Response (EDR), Security Information and Event Management (SIEM) implementation and management, and 24/7 Security Operations Center (SOC) services. Key qualifications include U.S.-based service providers with all district data remaining within U.S. borders, cybersecurity insurance of $2,000,000 per occurrence, and professional errors and omissions insurance of $1,000,000 per occurrence. The RFP evaluation criteria allocate points across eight dimensions: cost (25%), process and procedures (15%), experience and staffing (10%), EDR protections (10%), SIEM and log analysis (10%), 24/7 SOC (10%), integrations with existing systems (10%), and data reporting (10%). Critical deadlines include submission of signed Non-Disclosure Agreements to Brenda Kirchhoefer by January 28, 2026; mandatory pre-bid meeting on January 30, 2026, at 9:00 AM CST via Zoom; vendor questions due by February 5, 2026, at 5:00 PM; proposal submission deadline of February 25, 2026, at 2:00 PM CST through the Bonfire portal only; and Board of Education award approval targeted for March 26, 2026, with services commencing July 1, 2026, through June 30, 2029.

The procurement includes restrictions requiring vendors to complete the K-12 Community Vendor Assessment Tool (K-12CVAT-Lite) questionnaire addressing 61 substantive security questions aligned with NIST, ISO 27002, CIS Critical Security Controls, and HIPAA frameworks. Vendors must also comply with Missouri's E-Verify federal work authorization requirements and execute the state's Anti-Discrimination Against Israel Affidavit, applicable to contracts exceeding $100,000 or organizations with ten or more employees. The RFP does not identify any incumbent vendors or existing contractors but requires integration with the district's current security infrastructure. The contract term spans three years (fiscal years 2026-27, 2027-28, and 2028-29) with optional renewal for two additional twelve-month terms by mutual agreement, with vendors required to submit three-year annual pricing on the provided spreadsheet. While specific budget allocations are not disclosed in the RFP documents, the district reserves the right to reject any proposals, make split awards, or issue multiple awards, and all proposals become district property with no cost increases permitted during the initial contract term.