19 Cybersecurity Q & A

Description

REQUEST FOR PROPOSAL (RFP) RFP #2026-19 24/7 CYBERSECURITY MONITORING, PATCH MANAGEMENT, AND CYBER NETWORK MONITORING SERVICES JASPER COUNTY, SOUTH CAROLINA JUNE 24, 2026 ADDENDUM #1 QUESTIONS AND ANSWERS QUESTION 1 – Subcontract onsite Hi, would proposal be accepted without onsite support but subcontracted out? ANSWER 1 – No, onsite support is a requirement. QUESTION 2 – Licensing and Additional Questions Hello, I have a few questions I'd like to ask before submitting a formal bid. 1. How many endpoints, servers, users, firewalls, network devices, and sites are in scope? 2. What EDR, SIEM/logging, vulnerability scanning, and patch management tools are currently in use? 3. Does the County already own licenses for these tools, or should vendors include licensing? 4. Is the onsite resource required every week for the full contract term? 5. Are after-hours onsite responses expected, or can critical response be remote unless requested? 6. What CJIS/NCIC/SLED audit deadlines or known findings are currently active? 7. Should pricing assume unlimited incident response, or should major incident response be priced separately? Please let me know if you need clarification. ANSWER 2 – 1. Endpoints 630, servers 135, users 435, firewalls 41, network devices 140, and yes. 2. We do have an EDR+MDR. Scanning tools are available patching tools. 3. The County already owns licenses. 4. It is required every week for the term of the contract. 5. Onsite when necessary. 6. There are none pending. 7. All pricing should include incident. REQUEST FOR PROPOSAL (RFP) RFP #2026-19 24/7 CYBERSECURITY MONITORING, PATCH MANAGEMENT, AND CYBER NETWORK MONITORING SERVICES JASPER COUNTY, SOUTH CAROLINA JUNE 24, 2026 QUESTION 3 – Clarifying Questions Onsite staffing (Section 4.2). The RFP requires at least one dedicated cybersecurity resource onsite a minimum of four (4) days per week. 1. Will the County consider a hybrid delivery model — a primary 24/7 remote Security Operations Center paired with a named onsite resource present on a reduced or scheduled cadence (for example, one to two days per week plus incident-driven and audit-period onsite presence)? 2. If a strict four-day onsite minimum is required, may that resource be a qualified, locally based subcontractor working under the prime vendor’s direction? CJIS / NCIC / SLED compliance (Section 3.7). 3.