Managed IT Services

The vendor required to provide IT managed service provider (“MSP”) to support authority remote workforce and operations.
- General managed IT services
1. General IT management and help desk
•    Provide help desk and technical support during mountain time business hours (Monday - Friday, 9:00 am - 5:00 pm) for routine requests. 
•    Provide 24x7x365 availability for critical incidences, such as security breaches.
2. Device management
•    Implement mobile device management (“MDM”) capabilities to authority -owned devices to configure the devices, enforce security policies, and deploy software updates and patches. 
•    Restrict local administrator privileges on authority -owned devices. 
•    The offeror shall assume administrative control, ensuring that end-user accounts under “least privilege” access, while providing a fast process for legitimate elevation requests. 
•    Maintain the ability to remotely “wipe” authority -owned devices that are reassigned, lost, or compromised. 
•    The offeror shall act as the primary procurement agent for all authority IT hardware. 
•    This includes hardware specification, order fulfillment, initial setup, and direct-to-user shipping.
3. Cloud-based software administration
•    Administer licenses, users, permissions, security settings, and other pertinent settings for cloud-based software (e.g., google workspace, microsoft office applications, drop box). 
•    Monitor cloud software for unusual sign-ins, privilege escalation requests, and unauthorized applications. 
•    Conduct and report quarterly reviews on security settings. 
•    Assist authority in onboarding new staff members and offboarding departing staff members. 
•    Ensure the immediate removal of access and the preservation of data for departing staff members. 
•    Authority estimates three (3) onboarding or offboarding events per year.
4. Endpoint security and response
•    Maintain and monitor endpoint detection and response (“EDR”) solutions on all authority -owned hardware assets. 
•    The offeror may propose and implement new EDR solutions if current tools are insufficient for certification level 2 compliance. 
•    Provide 24x7x365 monitoring for malicious activity and quarantine threats immediately.
5. Backup and recovery
•    Implement and manage a backup and disaster recovery solution for all cloud-based file repositories (e.g., drop box, google drive) and email accounts (Gmail). 
•    The solution must ensure full recoverability in the event of ransomware, malware, data corruption, or accidental deletion. 
•    Perform quarterly tests on the recoverability of emails, files, and other data to validate backup and recovery ability and report the results to authority. 
•    Assist authority with developing an incident response and business continuity plan tailored to authority cloud-based environment and remote workforce. 
•    This may include, but is not limited to, procedures to restore service, communications during incidents, and failover options.
6. Website security and domain transition
•    Assist authority and its contracted marketing firm to implement or maintain security requirements for authority website.
•    Managing the complex transition of all email addresses, DNS records, and cloud service identities (e.g., microsoft 365 and google workspace usernames) to the new domain. 
•    Updating all single sign-on integrations and third-party software configurations to reflect the domain change, ensuring zero downtime for operations. 
•    Implementing permanent redirects to ensure traffic and emails sent to the domain are seamlessly routed to the new addresses.
- Target timeline for managed IT services
•    Provide help desk support immediately upon contract execution. 
•    The offeror shall assume management of and implement all solutions regarding MDM, EDR, backup and recovery, cloud license administration, and website security within four (4) months of the contract effective date. 
•    The migration to domain is considered a lower priority and should be completed within six (6) months of the contract effective date.