Managed Cybersecurity Services for School District Technology Infrastructure

Malden Public Schools ("MPS" or "District") is seeking qualified vendors to provide comprehensive Managed Detection and Response (MDR) cybersecurity services for the entire school district. The District serves approximately 6400 students across seven schools, with a technology infrastructure that includes Fortinet firewalls, Extreme switching and wireless, and Sophos endpoint protection.

The increasing sophistication of cyber threats targeting educational institutions necessitates a robust, proactive cybersecurity approach. This RFP seeks a comprehensive MDR solution that aligns with the Cybersecurity and Infrastructure Security Agency (CISA) Cross-Sector Cybersecurity Performance Goals (CPG), the CISA K-12 cybersecurity guidance, and the Center for Internet Security (CIS) Controls framework.

Malden Public Schools ("MPS" or "District") is seeking qualified vendors to provide comprehensive Managed Detection and Response (MDR) cybersecurity services for the entire school district. The District serves approximately 6400 students across seven schools, with a technology infrastructure that includes Fortinet firewalls, Extreme switching and wireless, and Sophos endpoint protection.

The increasing sophistication of cyber threats targeting educational institutions necessitates a robust, proactive cybersecurity approach. This RFP seeks a comprehensive MDR solution that aligns with the Cybersecurity and Infrastructure Security Agency (CISA) Cross-Sector Cybersecurity Performance Goals (CPG), the CISA K-12 cybersecurity guidance, and the Center for Internet Security (CIS) Controls framework. 2.

MDR SCOPE OF SERVICES The successful vendor shall provide a comprehensive Managed Detection and Response service covering the entire Malden Public Schools district network infrastructure for a three-year term.

The proposed solution must include the following core components: 2.1 Asset and Software Inventory 2.2 Vulnerability Management 2.3 Network Detection and Response (NDR) 2.4 Security Information and Event Management (SIEM) 2.5 Threat Intelligence 2.6 Security Operations Center (SOC) Services 2.7 Patch Management Assistance 2.8 Operational Technology (OT) Cybersecurity 2.9 Log Collection and Management 2.10 Incident Response and Remediation 2.11 Attack Surface Management 3.

VULNERABILITY MANAGEMENT SCOPE OF SERVICES 3.1 Vulnerability Detection and Remediation 3.2 Account Risk Mitigation 3.3 Incident Response Plan Development 3.4 Network Assessment and Remediation 3.5 CIS Controls Assessment and Planning 4.

TECHNICAL REQUIREMENTS 4.1 Compliance and Standards The proposed solution must demonstrate alignment with: • CISA Cross-Sector Cybersecurity Performance Goals (CPG) • CISA K-12 Cybersecurity Guidelines • Center for Internet Security (CIS) Controls (particularly Controls 1 and 2) 4.2 Integration Requirements • Compatibility with existing network infrastructure • Integration with current security tools and systems • API availability for custom integrations • Support for hybrid cloud and on-premises environments • No impact on network performance 4.3 Reporting and Analytics 4.4 Performance Requirements • 24/7/365 monitoring and response • Scalability to accommodate district growth 5.

VENDOR QUALIFICATIONS 5.1 Company Requirements • Minimum of 5 years’ experience providing MDR services • Demonstrated experience serving K-12 educational institutions • SOC 2 Type I or II certification • Professional liability and cyber liability insurance 5.3 References • Minimum of three (3) current K-12 references • References from similar-sized school districts preferred • Contact information for reference verification 6.

PROPOSAL REQUIREMENTS 6.1 Technical Proposal Vendors must provide a detailed technical proposal addressing: • Detailed description of proposed MDR solution • Integration approach and timeline • Incident response procedures • Training and knowledge transfer plans 6.2 Cost Proposal Provide detailed cost breakdown including: • Pricing for three-year term along with (2) one-year extensions.

• Implementation and setup costs • Hardware/software requirements and costs • Payment terms and schedule Agency: Universal Service Administrative Company (USAC) Status: Certified