RFI 20242007 Managed Security Operations Center and Managed Detection and Response Services

The City of Eugene and Lane County are conducting a Request for Information (RFI) #20242007 for Managed Security Operations Center (MSOC) and Managed Detection and Response (MDR) Services. The procurement seeks comprehensive cybersecurity services to provide 24/7 coverage for an environment consisting of approximately 3,500 endpoints, 350 servers, 1,959 Office 365 users, and 23 virtual machines in Azure. Key objectives include detecting intrusion, malware, and malicious activity across Windows 10/11, iOS, and Linux platforms, with a minimum log retention requirement of 180 days and an ideal retention of 365 days. The City currently utilizes various security controls including Checkpoint firewalls, Microsoft Defender, and Azure WAF, and is seeking a provider that can effectively integrate with and enhance their existing infrastructure. Potential vendors must demonstrate capabilities in threat intelligence, incident response, and comprehensive security monitoring. The RFI allows for vendor demonstrations, and Letters of Interest are due by December 14, 2023, at 2:30 PM, with the City planning to implement the selected MSOC/MDR services by February 2024.

No specific set-aside designations or restrictions for disadvantaged enterprises were explicitly mentioned in the procurement documents. The current incumbent for MSOC and MDR services is Rapid7, and the City is open to proposals that can either integrate with existing solutions like Windows Defender or implement a new managed SIEM solution. The existing technology infrastructure includes 11 domain controllers (4 in Azure), Cisco AnyConnect and NetMotion Mobility for VPN access, and public-facing web applications. While specific budget ranges were not disclosed, the RFI indicates the City is receptive to discussions about contract length if it results in cost savings. Four security service providers have been scheduled for demonstrations: AgileBlue, Crowdstrike/Dell, Converge/Arctic Wolf, and Palo Alto. The procurement involves network connections ranging from 1Gbps to 10Gbps, with potential for growth, and requires compliance with various regulatory standards including HIPAA, CJIS, and PCI.