Request for Qualifications - Managed Information Technology & Cybersecurity Services

Kearns Improvement District is requesting Statements of Qualifications from qualified service providers for managed information technology and cybersecurity services, with SOQs due September 15, 2026 and a Notice of Intended Selection targeted for September 17, 2026. Cybersecurity is the central focus. The District requires onsite support delivered directly by the prime contractor using local personnel based in Salt Lake County; subcontractors and remote resources cannot satisfy this requirement. All personnel responsible for Security Operations Center monitoring, security event analysis, incident response, and system access must be U.S.-based, with preference given to local Utah providers.

The scope encompasses 24/7/365 managed detection and response, endpoint and server management, network administration, backup and disaster recovery, water utility operational technology and SCADA cybersecurity coordination, incident response planning, penetration testing, quarterly phishing assessments, monthly cyber training, and strategic advisory services. The District operates 32 Microsoft 365 Business Premium users, two redundant physical host servers each running approximately nine virtual machines for business and SCADA environments, and manages 8–12 terabytes of backed-up data across redundant local servers, Synology drives, and daily cloud copies. Current infrastructure includes Sophos and Auvik tools; the selected provider has discretion to retain or replace these. The District has completed EPA Risk and Resiliency Assessments using CSET and AWWA Security Controls frameworks and will provide relevant findings post-award.

Minimum qualifications include at least five years of organizational experience providing managed IT and cybersecurity services, demonstrated 24/7/365 monitoring capability, ability to provide onsite support in Salt Lake County, experience managing Microsoft 365 environments, demonstrated cybersecurity experience with public entities or critical infrastructure, and ability to maintain required insurance including technology errors and omissions and cyber/privacy liability. Background screening at the provider's cost is required.

The District does not specify a predetermined budget, response-time SLAs, penetration-testing cadence, or particular software requirements. Offerors must provide detailed fee schedules showing onboarding costs, recurring services, included quantities, unit rates, licensing, project rates, after-hours rates, and third-party charges. Pricing will be evaluated separately from technical qualifications, with technical capability taking precedence. The initial contract term is three years with two optional one-year extensions, subject to successful contract negotiations, funding, performance, and Board approval. Service start date is January 1, 2027. An incumbent managed service provider is expected to submit a response. This RFQ does not guarantee any minimum quantity of work or expenditure. Questions were due August 31, 2026.