RFP: 407913 - Managed Detection and Response & Security Operations Center Services - IT

Background
The Hampton Roads Sanitation District (HRSD) is a political subdivision of the Commonwealth of Virginia, dedicated to treating wastewater and recovering natural resources to protect public health and the environment. HRSD has been serving over 1.9 million people across 20 cities and counties for more than 80 years. As a vital component of U.S. national critical infrastructure, HRSD is committed to enhancing its cybersecurity program in response to evolving cyber threats. This solicitation seeks qualified Offerors with demonstrated experience in providing Managed Detection and Response (MDR) and Security Operations Center as a Service (SOCaaS) capabilities.

Work Details
The selected provider will deliver a comprehensive, fully managed security solution aligned with the NIST Cybersecurity Framework (CSF). Key services include:

- 24/7 SOC monitoring and incident response
- AI-enabled Security Orchestration, Automation, and Response (SOAR)
- SIEM platform management
- Digital risk monitoring across surface, deep, and dark web sources
- Well-defined Service Level Agreements (SLAs)
- Active defense strategies
- Data leakage/breach support
- Vulnerability scanning
- Threat intelligence integration
- Regular reporting on posture and metrics
- Cyber risk protection services including credential leakage detection and executive digital risk monitoring.

The Offeror must demonstrate the ability to integrate seamlessly with HRSD's existing systems and provide scalable services that evolve with HRSD's cybersecurity maturity.

Period of Performance
The contract term will be from March 01, 2026 through February 28, 2027, with four optional annual renewals through February 28, 2031.

Place of Performance
Services will be performed at HRSD's facilities located at 1434 Air Rail Avenue, Virginia Beach, VA 23455.

Bidder Requirements
Offerors must provide proof of authority to transact business in Virginia by submitting their State Corporation Commission (SCC) number. The Offeror must have been in business for at least five years and possess a minimum of five years' recent experience providing similar services. Personnel proposed for senior-level roles should have at least ten years of relevant professional experience. All personnel providing cybersecurity-related services must hold current certifications from recognized global cybersecurity certification authorities.