Managed Security Service Provider (MSSP) RFP

The Metropolitan Transportation Authority (MTA) has issued a comprehensive five-year Request for Proposal (RFP) to engage a Managed Security Service Provider (MSSP) responsible for delivering 24/7 real-time cybersecurity monitoring, incident response, SIEM cloud environment management, and threat intelligence services across its IT and OT environments, with an option to extend for three additional years, potentially totaling eight years. The contract aims to bolster the MTA’s cybersecurity posture across multiple agencies and operational areas, including critical infrastructure, payment systems, and physical security. The procurement emphasizes strict confidentiality, requiring mutual nondisclosure agreements, and mandates that proposers register through the MTA vendor portal to obtain a bidder number before requesting bid documents or submitting proposals. The solicitation specifies a virtual pre-bid conference scheduled for late July, with proposals due electronically by mid-August, and emphasizes separate submission of technical and cost proposals, with the technical response limited to ten pages excluding attachments. The contractual framework is governed primarily by New York State law, with no explicit federal FAR clauses incorporated. The RFP details a multi-year contract with a base period of five years and three one-year options, with an estimated funding range of $50 million to $100 million, reflecting the scope and scale of cybersecurity services required. The evaluation process will consider technical merit and cost, with the possibility of oral presentations, negotiations, and multiple awards at the MTA’s discretion. The contract documents include references to standard MTA forms, confidentiality agreements, and attachments such as the Statement of Work and standard contract templates, but do not specify particular packaging, shipping, or inspection requirements, as the services are primarily remote cybersecurity functions. Administrative contacts are provided for proposal submission and portal access, but no specific payment procedures or contract signing dates are included, emphasizing the importance of compliance with procurement protocols. Overall, the solicitation seeks a qualified MSSP capable of supporting the MTA’s cybersecurity resilience through continuous monitoring, rapid incident response, and threat intelligence, under a flexible multi-year contractual arrangement.