Morrisville Town Opengov #325209

Managed SOC, SIEM, and mandatory NDR cybersecurity services for the Town of Mooresville

The Town of Mooresville is seeking a managed cybersecurity provider to monitor and protect its municipal IT environment. - Buyer: Town of Mooresville, North Carolina; Innovation & Technology and Purchasing. - Services requested: 24x7x365 managed Security Operations Center (SOC) and Security Information and Event Management (SIEM), with mandatory Network Detection and Response (NDR) covering both perimeter (North/South) and internal (East/West) traffic. - Scale and pricing: Provide all-inclusive tiered pricing for 700, 800, and 1,000 endpoints and servers, with implementation, annual service, ingestion and retention, incident response, optional services, and overages itemized. No product quantities or part numbers are specified. - Named OEMs, platforms, and vendors: Adlumin, Microsoft (Azure, Entra ID, Defender for Endpoint, and Intune), Cisco (Meraki, Umbrella, and Duo), Palo Alto Networks (firewalls and GlobalProtect VPN), KnowBe4, Mimecast, 1Password, SentinelOne, Darktrace, and CyberMaxx. Microsoft Defender for Endpoint may be proposed as a SentinelOne replacement; neither it nor other named platforms is specified as a required purchase. Bidders must address integrations, compatibility, licensing, limitations, migration, and additional costs. - Operational requirements: Analyst-led alert validation and investigation, threat intelligence and proactive hunting, documented escalation, operational and executive reporting, and a critical-incident notification target of 15 minutes or better. NDR architecture, sensor coverage, blind spots, and costs must be disclosed. - CJIS, data, and AI safeguards: Demonstrate CJIS-scoped environment experience and disclose security controls, personnel screening, hosting and access locations, subprocessors, encryption, MFA, retention, and secure deletion. AI capabilities must be auditable and human-supervised; customer data must not be used for unrelated model training without authorization, and CJI processing must be CJIS-safe. - Transition and experience: Provide an implementation and incumbent-transition plan with parallel operation, integration and detection validation, knowledge transfer, and rollback to avoid monitoring gaps. Vendors must provide three comparable public-sector references. - Term: Three-year initial term, with two optional one-year renewals at the Town’s discretion, subject to annual appropriation.

Description

The Town of Mooresville seeks proposals for managed 24x7x365 Security Operations Center (SOC) and Security Information and Event Management (SIEM) services, including mandatory Network Detection and Response (NDR). Work includes analyst-led monitoring and investigation, incident notification and escalation, threat intelligence, reporting, CJIS support, and network visibility for both North/South and East/West traffic. The Town has approximately 700–850 combined endpoints and servers and requests tiered pricing for 700, 800, and 1,000 assets, with a transition plan that avoids monitoring gaps and integrations with its existing security technologies. Proposals should also describe auditable AI-assisted capabilities, implementation requirements, licensing, retention, service levels, and total costs.

View original listing