RFP: Managed Security Operations Center (SOC), SIEM, and Network Detection and Response (NDR) Services

The Town of Mooresville seeks proposals from qualified cybersecurity service providers for a managed Security Operations Center (SOC), Security Information and Event Management (SIEM), and mandatory Network Detection and Response (NDR) solution. Services must include continuous 24x7x365 monitoring, analyst-led detection and investigation, incident notification and escalation, threat intelligence, reporting, and support for Criminal Justice Information Services (CJIS) requirements. The Town currently manages approximately 700–850 combined endpoints and servers and requires comparable pricing at 700, 800, and 1,000 assets. The solution must provide visibility into North/South and East/West network traffic, support existing security technologies, and offer a practical migration from incumbent services without gaps in monitoring. The Town anticipates evaluating Microsoft Defender for Endpoint as a possible replacement for SentinelOne; this is a planning assumption. The Town also seeks responsible, auditable AI-assisted security capabilities, including alert triage, event correlation, threat hunting, and incident reporting, with appropriate human oversight and protections for sensitive government and CJIS-scoped data. Proposers shall disclose implementation requirements, integrations, licensing, retention, ongoing service levels, and total costs. The Town will consider proposals based on the requirements and selection procedures set out in this solicitation.