RFQ: Co-Managed IT Services

I. INTRODUCTION

Michigan Virtual™ is requesting Quotes for a single organization to provide Co-Managed IT services over a three-year period. By releasing this RFQ, Michigan Virtual makes no guarantee of any awards of work to any respondents now or in the future.

II. BACKGROUND OF MICHIGAN VIRTUAL

Michigan Virtual is a 501(c)(3) organization located in Lansing, Michigan. Our mission is to advance both learning and teaching through research, practice, and partnerships. We specifically focus on the K-12 community and how digital technologies can drive student and professional learning. Today, Michigan Virtual operates the Michigan Virtual Learning Research Institute®, the Professional Learning Portal, and the Student Learning Portal.

III. DESCRIPTION OF THE REQUEST

Michigan Virtual is interested in procuring Co-Managed IT Services for a three-year term, with the option to issue a 90-day notice of termination in the event that the partnership is not meeting expectations. The proposals submitted should clearly distinguish between costs that require an initial capital investment and those that entail monthly service fees.

Michigan Virtual is looking for services from a company with experience serving similar sized and similar functioning organizations. Please include with the quote at least two (2) references from existing clients, preferably in education. 

Michigan Virtual understands that the majority of the support work can be done remotely. However, there may be instances where the vendor needs to be on-site at the beginning of the contract to familiarize themselves with the IT staff. Moreover, the vendor may need to travel to our office to resolve issues or work together with our onsite team members.

IV. INFORMATION ABOUT CURRENT IT STAFF POSITIONS

The Technology Operations team is lead by a Director of Technology Operations and also includes the following nine positions:

• 1 Full Time Application Support Specialist Position
• 1 Full Time IT Support Specialist I Position
• 2 Technology Operations Supervisors – these positions oversee the education technologies and 3 additional staff members who support LMS/SIS and other educational technologies.
• 1 Full Time Technical Writer & Application Support Specialist – Primary responsibilities also include administration of Sharepoint, Wrike and Freshdesk.

V. INFORMATION ABOUT CURRENT IT ENVIRONMENT

Detailed information about our current IT environment will be provided up execution of our Confidentiality and Non-Disclosure Agreement.

VI. DELIVERABLES

The expected deliverables for the Co-Managed IT Services are defined as:

1. Infrastructure Support Services (ISS) – Technical Support for infrastructure:
   1. Managed network services
      1. Patching and updating
   2. Monitoring services
      1. Remote Monitoring and Management (RMM)
      2. Network Monitoring
   3. Support of applications and other technology vendors;
      1. Business productivity applications
      2. Line of Business (LOB) application
      3. Vendor Liaison services
   4. Server support services (physical and virtual)
   5. Backup monitoring, management and maintenance
      1. See item 4.
   6. Incident, problem and change management response/support
   7. Provide a portal for tracking incidents, problems and requests made by IT staff.
   8. End of life equipment procurement and competitive pricing; proactive service to sunset aged equipment.
   9. Maintain up-to-date documentation of network topology and systems framework.
2. Provide an optional hourly rate for User Support Services
   1. Technical Support for Michigan Virtual end users, at least for basic troubleshooting
   2. Onboarding/offboarding of Michigan Virtual staff
   3. Vacation coverage for select Technology Operations staff
3. SAAS
   1. Management software for monitoring firewalls (Palo Alto)
   2. Email security
      1. Email security, spam filtering for existing Office 365 environment
   3. Managed Endpoint Detection and response (EDR) solution
      1. Software and alerting services
   4. Privileged Access Management Tool
   5. Cybersecurity Training platform
      1. Trainings
      2. Phishing simulation
      3. Reporting
      4. Customization of templates and whitelabeling
4. HAAS – Backup
   1. Managed backup appliance
   2. Storage included for backups (60TB+)
5. Planning and Strategy
   1. Fractional Chief Information Security Officer Services, approximately 40 hours per year
      1. Hourly rate for additional hours.
   2. Annual summary technology plan
      1. Budgets technology/infrastructure projects and upgrades
      2. Provide recommendations for future enhancement to better meet our organizational goals and objectives
   3. Quarterly recap and advisory meetings with Fractional CIO
6. Additional Recommended Services
   1. If there are standard or recommended services that you provide and/or were not listed above, please provide a description of those and cost on the quote sheet.

VII. QUOTE INSTRUCTIONS

A. QUOTE CONTENT AND FORMAT
In order to simplify the evaluation process and obtain maximum comparability, Michigan Virtual requires that all responses to the RFQ be organized in the manner and format described below. Any relevant supplemental information should be included as attachments.

1. Business Information. Describe your business including legal business name, the year the business was organized, legal status (corporation, partnership, sole proprietorship, etc.), and the state of incorporation. Detail your organization’s experience with technology-related and/or educational organizations of comparable size and scope.
2. Qualifications and Deliverables Review.
   • Define how you will satisfy the proposal deliverables and why you are best suited to do so.
   • Provide itemized pricing for each deliverable or related set of deliverables using our Quote Form.
   • Include a narrative budget justification.
3. Requirements Definition Process. Briefly outline the process you will use to onboard Michigan Virtual as a new client. Provide names of any additional subcontractors or vendors that may be used. Clearly identify any requested services that are not provided or you cannot support due to equipment or other reasons.
4. Key Team Members. Identify the individuals who will provide services, if awarded the work, and provide brief descriptions of qualifications.
5. Client References. Provide the names and contact information for a minimum of three similarly sized clients for reference purposes who we may contact.
6. Nondisclosure Agreement (NDA). All entities wishing to submit a response to this RFQ are required to sign and submit Michigan Virtual’s Confidentiality and Nondisclosure Agreement along with their Quote in response to this RFQ.

B. SELECTION CRITERIA

The following factors will be considered by Michigan Virtual in making the Award.

• Preference given to Michigan-based businesses.
• Fit between requirements and Michigan Virtual’s needs.
• Technical and security expertise and experience.
• Ability to meet the defined timeline and understanding of the work services to be performed.
• Quality of references.
• Completeness of the Quote.
• Value delivered in proportion to total expected expenses.

C. CONFIDENTIALITY

Contents of quotes, proposals, and or future contracts are confidential and will not be disclosed to any parties outside of Michigan Virtual during or after the review process. Michigan Virtual, as a private nonprofit corporation, is not subject to FOIA.

Michigan Virtual reserves the right to make the Award to the entity of its choosing, reflective of our understanding of needs, the audiences served and results desired rather than solely based on pricing or other combinations of factors. Further, this RFQ does not obligate Michigan Virtual to award any contract. We reserve the right to cancel the RFQ at our discretion.

D. RFQ QUESTIONS, DUE DATES, CONTACT

Here are key dates to be aware of for this RFQ process. It is not uncommon for dates to change. Participating vendors will be notified of changes during the process. 

Date	Item
Monday, April 3, 2023	RFQ distributed
Week of April 10, 2023	Written Vendor questions submitted to Michigan Virtual
Week of April 10, 2023	Michigan Virtual responds to Vendor questions/inquiries
Week of April 24, 2023 (NEW DATE)	Written Quotes due to Michigan Virtual
Weeks of April 24 and May 1, 2023	Virtual 1-hour interviews for advancing vendors
Week of May 1, 2023	Reference checks for advancing vendors
Week of May 1, 2023	Begin contract negotiations

Please direct all correspondence and questions related to this RFQ and the required elements as indicated below. 

1. Emailed questions are due by Monday, April 10, 2023. Michigan Virtual will post written questions and our responses within 1-2 business days under the Question and Answers heading below. If time permits, Michigan Virtual is also open to scheduling 30 minute meetings to answer questions.
2. One (1) electronic copy of your Quote sent by email to the contacts below no later than noon EST on Monday, April 24, 2023.

The point of contact for RFQ #04032023: 

Joe Freidhoff
Vice President
[email protected]
Michigan Virtual
920 Municipal Way
Lansing, MI 48917

Please cc Kristen Crain, [email protected] on email communications.

Michigan Virtual reserves the right to not consider late or incomplete Quotes. Amendments to Quotes will be included in our review only when they are received by the above deadline.

VIII. QUESTIONS AND ANSWERS

RESPONSES POSTED 4/7

How many 2012 servers are in use, and is there a plan to upgrade/replace them, or is there a risk acceptance for those servers to continue in the environment after 2012 reaches Extended End of Life on October 10, 2023?

We expect all of the upgrades/decommissions to be completed before October.

How is Google Workspace being used operationally?

Google Workspace for Education Fundamentals (All Users: FT and PTI Staff) and Google Workspace for Education: Teaching and Learning Upgrade (5 Licenses). Google Workspace is primarily used by staff for collaboration: Google Docs, Google Slides, Google Sheets and Google Drive. We do not use Calendar, Gmail and a very small portion of staff have access to more tools such as Google Meet (5 licenses). 

What is the size and scope of the Horizon VDI environment? Who are the primary users?

Our current virtual manchine (VM) count is around 116, consisting of both virtualized workstations and servers, with 16 housed in-office and the remainder located in our data center. Finance, Integrations, and Infrastructure departments are the primary users of these VMs.

Are Thin Clients in use?

No.

Is support for the security/audio/visual environment to be considered in-scope for the Managed Services or is this support being retained in-house?

In-scope, if possible. General operational support is retained in-house, but maintenance and upgrades are typically done by a third party vendor. We hope to have those upgrades and the management of those devices managed by our Managed Services Provider, if possible.

Is support for the Zoom VoIP phone environment to be considered in-scope for the Managed Services or is this support being retained in-house?

No. It will be in managed in house.

Is the Zoom environment being utilized for CRM or any other services in addition to PBX?

No. Zoom is also being used by phone, web meeting services, occasionally including webinar, events and large scale meetings. It is also being used by our Customer Care team for call routing.

Line of Business Applications: Please list LOB applications, and indicate whether they are hosted internally within Michigan Virtual’s server environment or are SaaS Applications in the cloud.

We will add this information to the IT Environment document and resend to those who have received it.

Vendor Liaison Services: Please describe the expected level of service required by the Managed Service Provider.

Question seems more applicable to a conversation and written response. We are open to scheduling 30 minute meetings to answer such questions.

Backup Monitoring, Management, And Maintenance: Is the expectation that the MSP would manage the existing Datto backup solution, and is it desired that any Virtual Machines running in the Datto Cloud environment would be included in the MSP’s monitoring solution? 

Yes to both.

ITSM Portal for IT Staff: Please provide the number of MVL IT staff who need a license for the ITSM, and level of interaction required for supporting the services. 

Approximately 3 licenses. The level of interaction required for support services varies. This is likely the highest ongoing touch point between our organization and the MSP. This likely warrants a more in depth conversation to get into the scope of support services. 

Vacation Coverage for select IT Operations Staff: Please describe the skillset and scope required for Section 2.3 Vacation Coverage, and which select positions would need to be covered. Include estimated hours per year per position and anticipated notice to be given for this service.

Skills would include remote support services and the ability to resolve technical support issues remotely. The person may need to comes onsite if the issue cannot be resolved remotely. We estimate the number of hours would be less than 40 and would covering our IT Support Specialist position and potentially our Application Support Specialist position. We anticipate providing 30 days notice.

Email Security: Is there an email server on-premises or is Michigan Virtual fully using Microsoft Office 365 in the cloud for email?

There is no on-premise for email, we use Microsoft Office 365 with the filtering service identified in the IT Environment document.

Managed Endpoint Detection and Response (EDR) Solution: What is the current EDR in use? Is the expectation that the MSP maintains the existing EDR or provides a different one?

Our specific EDR is mentioned in IT Environment document. We are not opposed to moving to a new solution if a better option fits our needs and budget.

Please clarify the expectation related to Software and Alerting Services.

We currently use the monitoring system mentioned in the IT Environment document to monitor the health of our infrastructure, and we have a dashboard visualization up in the office. Additionally, we have another monitoring system through Uptrends that monitors SSO functionality on high priority systems. This is also monitored by our current MSP.

Privileged Access Management Tool: What is the current PAM tool in use? Is the expectation that the MSP maintains the existing PAM tool or provides a different one?

We are currently using the PAM identified in our IT Environment document. We are not opposed to moving to a new solution, if a better option fits our needs and budget.

Cybersecurity Training Platform: What is the current cybersecurity training platform in use, or is one needed for MVL to white label?

We are likely to be changing our training platform in the near future, and we are open options that meet our needs and budget.

HAAS: Is the expectation that the MSP would manage the existing Datto backup solution, or provide a backup solution to handle 60+TB with an offsite component? 

Either option may be proposed.

Quarterly recap and advisory meetings with Fractional CIO: Do you have a fractional CIO in place or are you asking for the MSP to provide that service/resource?

We currently have a temporary fractional CIO solution in place. We are asking the MSP to include those services or access to that resource in their quote.

Are all of the offices/employees located at one campus, or are there other locations that are to be supported?

We have one location, but we do have a lot of staff who are remote.

Are the physical servers, storage arrays, and backup appliances located on-site at Michigan Virtual’s offices, or are they co-located at a third-party datacenter facility, or other?

Third Party data center facility.

Are there printers under third-party management agreements?

We have a printer/copier/fax unit that is under agreement. The rest are managed in house by our team on a print server.

Are there personal printers that should be considered in scope?

No

Is the Microsoft 365 and Google Workspace data being backed up outside of the respective cloud platform? Please include storage size if relevant.

No

What is the internet connection bandwidth?

2x1GB dedicated connections

Are there existing solutions in place in the environment for server/workstation patching, remote workstation or mobile device management, system monitoring, system configuration, and end-user remote work/VPN access?

The current MSP conducts weekly scheduled maintenance on server and workstation via the RMM. The MSP and MV are jointly responsible for group policy and system configuration. The MSP manages the VPN and there is no MDM currently.

For User Support Services, is “end-user” support referring to employees of MVU, or any user of MVU (meaning is there an expectation of supporting a student/teacher at a school)?

End user refers to Michigan Virtual staff only. 

For monitoring of the Palo Alto firewall and other various software, are you looking for a SIEM or to have a vendor with a platform to fully adopt and manage the appliances/software?

We are open to either option.

For the phish threat training/education you state the need for a white label solution. Is this a non-negotiable, or is a customizable option OK that will still have the branding of the product?

Either option may be proposed. SSO is preferred and/or passwordless access to the content via email.

Do you have an approximate count of users that would be added to the phish threat training/education platform?

Approximately 400.

Do you have approximate device counts for the EDR solution for servers vs. client computers?

Approximately 152 end user devices, 46 servers 

Do you have requirements for the backup appliance to have onsite storage in addition to cloud storage, or are multiple cloud storage targets without a local cache acceptable?

We may be open to a multiple cloud storage option.