Massachusetts RFQ 26-04667: Security Operations & Splunk Engineering Support (ITS78-only prime)

Executive takeaway

This RFQ is for security operations and Splunk engineering support through the Executive Office of Technology Services and Security. The gating factor is eligibility: respondents must be current awarded bidders under Statewide Contract ITS78. If you are not on ITS78, this is still potentially worth pursuing, but only through a clearly-defined collaboration where an ITS78 vendor submits the bid.

Response deadline: 2026-03-18 15:00 (UTC)

What the buyer is trying to do

The buyer is soliciting bids to provide security operations and Splunk engineering support. The posting indicates that full scope and expectations are contained in the RFQ documents, and eligibility is tied to the ITS78 statewide contract.

What work is implied (bullets)

• Deliver ongoing security operations support (verify exact coverage model, hours, and responsibilities in the RFQ attachments).
• Provide Splunk engineering support (verify expectations such as data onboarding, tuning, content development, and platform administration in the RFQ attachments).
• Operate within the procurement vehicle constraints of Statewide Contract ITS78.
• If teaming, document a clear division of duties between the ITS78 prime and any collaborators (explicitly called out in the notice).

Who should bid / who should pass (bullets)

• Should bid: Vendors that are currently awarded bidders under ITS78 and can credibly cover both security operations and Splunk engineering.
• Should bid: ITS78 primes that can assemble a team quickly for a near-term deadline and can clearly define partner roles.
• Should pass (as prime): Any vendor not awarded on ITS78 (the notice states they cannot submit directly).
• Should consider teaming (not prime): Non-ITS78 firms with strong Splunk/security ops capabilities that can support an ITS78 prime with well-defined tasks and deliverables.

Response package checklist

• Confirmation that the submitting entity is a current awarded bidder under Statewide Contract ITS78 (verify required proof in attachments).
• Technical response addressing security operations approach (verify required format/sections in attachments).
• Technical response addressing Splunk engineering support approach (verify required format/sections in attachments).
• Staffing plan and roles (verify required resumes/certifications in attachments).
• If teaming: written explanation of the relationship and duties between the ITS78 prime and collaborators (explicitly required in the notice; verify any mandatory template language in attachments).
• Pricing submission (verify pricing worksheet, rate card, or format in attachments).
• Any mandatory forms, representations, and submission instructions (verify in attachments).

Pricing & strategy notes

Because the notice provides limited pricing detail, treat the RFQ attachments as the source of truth for what can be priced (e.g., labor categories, hourly rates, fixed-price tasks, or hybrid structures). A practical approach:

• Start with ITS78 constraints: confirm what pricing constructs are permitted/expected under ITS78 for this RFQ (verify in the RFQ).
• Benchmark using comparable work: pull your internal history for security operations support and Splunk engineering support delivered to state/public-sector clients, then map to the RFQ’s required roles and service levels (verify required roles in attachments).
• Reduce ambiguity with assumptions: where the RFQ leaves room for interpretation, explicitly state assumptions in the proposal—especially around support hours/coverage, scope boundaries, and what is included vs. out-of-scope (verify if assumptions are allowed in attachments).

Subcontracting / teaming ideas (bullets)

• Non-ITS78 Splunk specialists can team with an ITS78 prime, with a clearly documented split of responsibilities (the notice explicitly allows collaboration if the ITS78 vendor submits).
• Pair an ITS78 prime with a partner that can focus on Splunk engineering support while the prime handles overall security operations delivery and contract compliance (final structure must match RFQ requirements—verify in attachments).
• If your firm is non-ITS78, prioritize identifying an ITS78 prime that already sells security services to Massachusetts agencies and can submit quickly under the deadline.

Risks & watch-outs (bullets)

• Eligibility risk: Only current ITS78 awarded bidders can submit as prime. If you are not on ITS78, you must team and let the ITS78 vendor submit.
• Teaming clarity risk: The notice warns that the relationship and duties must be clear when collaborating—unclear division of labor can weaken responsiveness.
• Scope uncertainty: The notice says “See RFQ for complete detail.” Do not assume service hours, tooling scope, or deliverable cadence—verify in attachments.
• Schedule risk: Short turnaround to the 2026-03-18 deadline; plan internal reviews and teaming agreements early.

Related opportunities

• RFQ-26-04707 MoveIT Modernization Project

How to act on this

1. Open the BidPulsar notice and pull the RFQ attachments: RFQ 26-04667 for Security Operations & Splunk Engineering Support.
2. Confirm prime eligibility under ITS78; if not eligible, identify an ITS78 prime and draft a roles-and-duties teaming summary.
3. Build the response around the RFQ’s required scope and submission format (do not infer missing requirements).
4. Submit by 2026-03-18 15:00 (UTC) following the RFQ instructions.

If you want help deciding whether to bid, shaping a compliant response, or finding a viable ITS78 teaming path, engage Federal Bid Partners LLC.