Managed Detection and Response (MDR) Services [P-67709]

The City of Pasadena is seeking a Managed Detection and Response (MDR) Services vendor to establish a comprehensive cybersecurity service within their Microsoft 365 tenant. The procurement focuses on creating a 24x7x365 tenant-resident MDR service with full operational control of the Security Operations Center (SOC) function, initially targeting endpoint protection and Microsoft-native telemetry for approximately 2,500 Microsoft 365 licensed users. Key objectives include enabling internal teams to concentrate on higher-tier analysis and strategic initiatives while building a sustainable, co-managed environment with full documentation and portability. The vendor must provide Tier 1 endpoint detection, containment, and remediation services, with an architecture designed for future expansion to include identity, network, and infrastructure log integration. Evaluation criteria include implementation approach (30%), detection and response capabilities (25%), experience and organizational qualifications (20%), cost (20%), and small business status (5%). The proposal is due by 2:00 pm on December 5, 2025, with an initial three-year contract term and potential for two optional one-year extensions. The project is partially funded by the U.S. Department of Homeland Security through the State and Local Cybersecurity Grant Program.

The solicitation appears open to various business types, with a slight preference for small businesses as indicated by the 5% evaluation criteria weighting. While no specific set-aside designations are explicitly mentioned, the RFP requires vendors to demonstrate experience in public sector MDR services, particularly in Microsoft 365 environments with co-managed, tenant-resident implementations. Proposers must provide detailed information about five customer engagements, including at least two public sector clients and two hybrid or cloud-native Microsoft 365 environments. The city anticipates additional Microsoft licensing requirements, which will be procured through their existing Microsoft Enterprise Agreement. Vendors must also comply with various federal and local requirements, including lobbying disclosures, conflict of interest declarations, and insurance specifications, with Cyber Liability insurance set at $5,000,000 per occurrence. While a specific budget range is not disclosed, the procurement suggests a comprehensive and potentially significant investment in cybersecurity infrastructure for the City of Pasadena.