The vendor is required to provide for 24/7 security event monitoring, alert triage, and escalation services to assist the district's information security team in identifying and responding to potential cyber threats.
- Include information for 1 – 3 support capabilities:
1. Monitoring and escalation only
• Security event monitoring: continuous (24/7/365) observation of log sources and telemetry to detect potential security events
• Alert triage: initial review and prioritization of events based on severity, business impact, and urgency
• Escalation and notification: timely notification of significant alerts to designated district personnel via agreed communication channels (e.g., email, SMS, phone, or ticketing system)
2. Monitoring + limited response support includes all level 1 services, plus:
• Advanced log analysis: correlation of complex events across multiple platforms
• Containment support: guidance or automation to isolate infected hosts
• Coordination: notification and context for exposed assets, including CVE tracking or patch advisories
3. Full managed detection & response (MDR)
• Proactive threat hunting: manual or automated searching for signs of compromise or unusual behavior
• Forensic investigations: support for incident analysis, data recovery, and root cause determination
• Tailored playbook development: custom response workflows aligned to district priorities.
- Questions/Inquires Deadline: May 13, 2025