The vendor required to provide augmented information technology (IT) managed services (in-house as needed and remotely maintaining, monitoring, supporting) including telecommunication services to include the following:
• Network and infrastructure management
• Server management and modernization
• Advanced cybersecurity protection
• Identity and access control management
• Data backup and disaster recovery
• Patch management and system updates
• Strategic IT guidance and planning
• Security documentation and auditing support
• Incident response support
1. Network and infrastructure management
• Provide 24/7/365 monitoring of authority network devices, including:
o Switches/firewalls/routers/workstations/wi-fi systems/other
o Specialized Vlans for physical security networked devices (e.g., cctv, access readers, etc.)
• Provide management, deployment, and ongoing configuration and update support for authority network devices.
• Provide proactive communication and escalation (as required) for scheduled changes and alterations requiring networking system outages.
• Provide proactive communication and escalation (as required) for unscheduled changes and alterations inducing networking system outages.
• Ensure network devices are tracked for end-of-life (EOL), or vendor support requirements, as required.
• Proactively communicate with authority any network assets requiring EOL overhaul or vendor support.
• Provide infrastructure, authentication, and network support for internally managed business applications to ensure system stability and secure connectivity.
• authority prefers to retain application-level administration.
• Maintain the network, power, and storage infrastructure supporting physical security systems (cctv, badge access, unify cameras).
• authority prefers to retain responsibility for day-to-day operational use such as badge creation or footage review.
2. Server management and modernization
• Provide 24/7/365 monitoring of authority on-premises servers, including the new Hyper-V cluster.
• Monitoring scope is to include, but not limited to, server health, performance, and effectiveness of security measures.
• Provide ongoing (proactive and reactive) maintenance of authority on-premises servers, to include identification and implementation of critical security and system patches on servers in coordination with services such as patch management.
• Develop and execute plan to modernize authority operating systems, soliciting requirements from authority stakeholders to ensure alignment with authority objectives and business needs.
• Provide proactive communication and escalation protocols for server and networking systems, based on the severity of any unscheduled outages.
• Provide updates to authority on a monthly basis, to be included in the monthly executive summary, on maintenance of on-premises servers, including, but not limited to, recent patches and configuration changes, updates on modernization efforts, decommissioned and newly commissioned servers, and relevant metrics on server health and performance.
3. Advanced cybersecurity protection
• Provide 24/7/365 continuous monitoring and detection capability, to include threat monitoring, inducing response requirements to security incidents within the authority environment.
• Incident response requirements are prescribed within the incident response support section.
• Provide 24/7/365 dedicated point of contact for reporting any suspicious activity or potential security incidents observed by authority personnel.
• Deploy and manage intrusion detection and prevention capabilities across the authority environment.
• Deploy and manage a vulnerability scanning solution across the authority environment and provide routine internal and external scanning on a weekly basis.
• Remediate or recommend corrective actions for identified vulnerabilities.
• Incorporate high and critical vulnerability metrics, such as open or resolved, within the monthly executive summary.
• Deploy and manage solutions to detect and block common cybersecurity threats through email such as phishing, spoofing, malware, and business email compromise (BEC).
• Provide relevant security metrics into monthly status report such as detected threats and response actions, vulnerability scan results, blocked email threats, threat statistics (as applicable), and any other relevant security metrics for the authority environment informing threat awareness.
4. Identity and access control management
• Support active directory domain services and all related infrastructure components, including group policy, authentication services, and directory replication, to ensure secure and reliable operation in accordance with authority configuration and uptime requirements.
• Deploy and manage an MFA solution (e.g., cisco duo) for all user accounts, to include privileged and remote access accounts.
• Implement controls to manage, monitor, and restrict privileged access to only authorized personnel based upon the principle of least privilege.
• Support authority user access reviews across all authority accounts, including privileged and remote access, as required.
• Operate as tier 2 escalation for incidents or requests that exceed authority tier 1 capability or defined time thresholds. (Tiered support model is defined in section n)
• Provide advanced troubleshooting and resolution for issues requiring specialized tools, elevated privileges, or deeper technical analysis (e.g., complex authentication issues).
• Support user onboarding and offboarding by provisioning or deprovisioning accounts in managed systems upon authorized tier 1 request.
• Coordinate with authority internal IT to ensure seamless hand-off, clear ticket ownership, and visibility throughout the escalation lifecycle.
• All tier 2 requests are governed by defined service level agreements for acknowledgment, response, and resolution.
• All privileged access performed by the contractor, including administrative and service accounts, shall be logged and auditable.
• Privileged sessions shall be subject to monitoring and retained for a minimum of twelve (12) months, unless otherwise required by law or audit.
• Support quarterly privileged access reviews and provide written attestation confirming that privileged access remains limited to authorized personnel and consistent with the principle of least privilege.
5. Data backup and disaster recovery
• Provide support for authority ability to recover authority operations based upon defined recovery time objectives (RTO) and recovery point objectives (RPO), or similar implemented metrics, agreed upon between the managed services provider (MSP) and authority.
• Provide backup and redundancy support of all identified and agreed upon authority data and systems that are being managed by the MSP daily.
• Authority prefers backups to be stored in an alternate location to the primary MSP location (e.g., offsite).
• Implement secure storage capabilities (encrypted and immutable) for all identified and agreed upon authority data and systems being backed up by the MSP.
• Test all managed backups of identified and agreed upon authority data and systems on at least a quarterly basis and provide test results to authority post testing.
• Provide a direct point of contact and 24/7/365 available support to activate any required contingency operations in the event of realized disruption to authority operations.
• Configure backup and storage retention schedules in alignment with client data retention and compliance policies, ensuring data is securely stored and deleted per policy.
6. Patch management and system updates
• Maintain all managed servers, networking devices, applications, and endpoints (e.g., workstations) with current vendor-supported security patches, software updates, and firmware releases.
• Deploy patches based upon a documented process supporting timely updates based upon either criticality or priority and provide a reporting mechanism for patching across the authority environment.
• Manage and apply all operating systems and common software patches/updates on a regularly scheduled basis.
• Coordinate patch scheduling with authority personnel, as required, to minimize operational downtime or impacts.
• The MSP contractor shall report any forecasted impacts or required downtime to support necessary patching or updates within the monthly executive summary.
7. Strategic IT guidance and planning
• Provide inputs into authority long-term strategic technology plan and roadmap on a monthly basis, to be included in the monthly executive summary or a distinct artifact as necessary.
• Advise authority on the enablement of technology (e.g., software and tools) to fulfill its overall mandate and achieve business objectives.
• Provide detailed recommendations on authority primary security initiatives, including, but not limited to, microsoft 365 optimization, Hyper-V cluster migration, software management, and the onboarding of new technologies and platforms.
• As part of advisory to security strategic and initiatives, provide authority with guidance to maintain compliance with all applicable security standards.
• Assist authority with the identification of new compliance requirements and the mitigation of findings of non-compliance.
8. Security documentation and auditing support
• Develop and maintain authority IT infrastructure and security architecture documentation, to include documentation of security configurations and settings.
• Updates are to be made as necessary and shared as part of the monthly executive summary.
• All security documentation is to undergo a review and update cycle annually, in coordination with authority stakeholders.
• Develop and maintain documentation on agency alignment with a recognized industry security framework to prepare for and respond to internal or external security audits and demonstrate adherence to security best practices.
• The selected framework is to be identified during onboarding, and any material deviation from the selected framework shall require prior written approval from authority.
• Updates are to be made as necessary and shared as part of the monthly executive summary.
• All security control and audit documentation are to undergo a review and update cycle annually, in coordination with authority stakeholders.
• Provide targeted recommendations and ongoing support to authority in updating or addressing gaps in IT infrastructure, security architecture, and security control documentation.
• Implement and maintain technical controls aligned with authority security policies and provide evidence and reports to support client-led audits or compliance reviews.
9. Incident response support
• Support the execution of authority incident response process in the event of a security incident or breach.
• Service level agreements shall be jointly established between authority and the contractor during onboarding to establish clear expectations for response acknowledgment, containment initiation, communication cadence, and post-incident reporting.
• Monitor covered systems for potential security incidents, validate alerts, and escalate confirmed or suspected incidents to designated authority personnel within agreed service-level response times.
• Participate in authority -led incident response activities, providing timely status updates and technical details during investigation and recovery.
• Maintain accurate and auditable documentation of all actions performed during the incident response lifecycle.
• Participate in authority tabletop or simulation exercises as requested to validate communication and escalation workflows.
10. Information technology training
• Support the execution of authority incident response process in the event of a security incident or breach.
• Service level agreements shall be jointly established between authority and the contractor during onboarding to establish clear expectations for response acknowledgment, containment initiation, communication cadence, and post-incident reporting.
• Monitor covered systems for potential security incidents, validate alerts, and escalate confirmed or suspected incidents to designated authority personnel within agreed service-level response times.
- Contract Period/Term: 5 years
- Questions/Inquires Deadline: January 26, 2026
