01
Cloud-native architecture
Globally distributed points of presence, automatic threat-intelligence updates, elastic scale with no major infrastructure change.
Pre-bid brief · Live RFP · Under NDA 
A prime's pre-bid brief for Holland Ref 0000426310.
City of Holland, Michigan, a cloud-delivered Security Service Edge platform for every user, device, and location. One award, one prime, Techtiz builds the technical-response engine behind it.
Live · closes Jun 22, 11 AM EDT
Awarding body City of Holland
Jurisdiction Michigan
Status Responding under NDA
Solicitation
Ref 0000426310Cloud-Delivered SASE, sealed
Scope
Security Service EdgeCloud-native, no appliances
Award
Single vendorNew contract, lump sum
Techtiz role
Back-officeNDA-first, never agency-facing
Schedule of events
One sealed deadline, no cure.
A sealed, formal RFP. Written questions go to one person by June 15. Anything arriving after 11:00 AM EDT on June 22 is rejected, and email submissions are never accepted.
Published
Solicitation issued, 7:13 AM EDT
Questions due, 12 noon EDT
Written, to Joe Firmiss only. Phone calls not accepted
Q&A posted
To cityofholland.com. No fixed release date stated
Proposals due, 11 AM EDT
Sealed. No email. No cure for late arrival
Live
20 days from issue to close. Today the clock is running.
The award model
Single vendor, new contract, full and open.
This is a relationship-driven single award, not a multi-pool roster. One firm wins the whole contract, and the prime that wins carries it. There is no piggyback, no set-aside, and no small-business preference.
StructureOne winner, full and open competition. A single vendor is selected for a new contract, with no roster and no split between firms.
PricingA single lump sum is required. Time-and-materials, unit rates, or a schedule without one total are non-responsive.
ProcessSealed and formal. Proposals are opened together after the deadline. Email submissions are not accepted, including to the questions contact.
TermNot stated in the solicitation. The vendor proposes the implementation timeline. Independent reads estimate roughly 16 to 20 weeks to deploy, an estimate, not a city figure.
Scope · The differentiator
Native Microsoft Entra ID, Azure AD, and Active Directory integration is the strongest technical hook in this procurement.
Most Michigan municipalities run Microsoft-heavy environments. A bid that shows the identity-integration architecture in a diagram, and explains policy by user, group, and organizational unit, signals real domain understanding rather than a capability brochure. Generic content that names products without an architecture loses here.
This is the section Techtiz drafts and diagrams, mapped to the city's identity model, not a list of product names.
Task allocation
What a remote technology team can build, and what stays onshore.
The boundary that makes a compliant Subcontracting model work on a cloud-security procurement.
Contractual, not statutory. This solicitation contains no offshore prohibition, no data-residency clause, and no citizenship or clearance requirement. The limits are prudential and contractual. The US prime must be the named respondent and the contract signatory and carries all legal accountability, a signed NDA must be in place before any tender material moves, and certain post-award data and live-environment tasks stay onshore.
Remote technology & back-office Subcontracting
Pre-production, no city data
Draft all nine technical capability sections and the full compliance matrix
Design the architecture and write the integration narrative from public platform documentation
Design platform configuration for DNS, Secure Web Gateway, cloud firewall, and CASB in a pre-production environment
Design SIEM and API integration
Design DLP policy, design only, not live execution
Draft SLAs, the deployment methodology, and training materials
Run lab and pre-production testing
Generate SLA and compliance reports from platform analytics that carry no raw city data
Techtiz operates only in this column, behind the prime, under NDA, in pre-production, never touching live city systems.
US prime only
Onshore, accountable, live systems
Signing the contract and submitting the sealed proposal
Handling city network topology data after award
Executing identity integration against the live city Active Directory and Entra ID
User acceptance testing in the live city environment
Delivering instructor-led training to city staff
Handling security log data and city staff personal information
All communication with the City of Holland
Gates, stated plainly. A signed NDA that names the City of Holland and this solicitation must be in place before any data moves. It prohibits onward disclosure of pricing or technical approach, requires return or destruction of materials if the bid is not awarded, and survives termination for at least two years. City network diagrams, identity credentials, security logs, and staff personal data are US-prime-only and stay within US infrastructure.
Where bids fail
Email submission Sealed process
The rule
This is a sealed RFP. Proposals may not be emailed, including to Joe Firmiss.
If you miss it
An emailed proposal is an automatic disqualifier. Submit through the stated sealed channel only.
How scoring works
Four criteria, unweighted, and the order matters.
The city publishes no numeric weights. The sequence is meaningful: completeness leads, so an incomplete submittal is effectively pass or fail before price is read. Compensation is last, which reads as table stakes after responsiveness, capacity, and risk posture.
Indicative weights, analyst estimates, not city figures
A Completeness of submittal~35%
B Experience & capacity of respondent and staff~30%
C Quality & methodology of insurance placement program~20%
D Compensation philosophy~15%
No interview, oral presentation, or shortlist stage is stated in the RFP. A best-and-final-offer round is not referenced, but it is common in Michigan municipal practice, so keep pricing headroom. Where the RFP body and outside analysis differ, the RFP body governs.
Full scope
Nine capability areas, plus identity and integration.
The technical response maps heading-for-heading to these. The clause index runs to roughly 44 SHALL requirements across about 51 clause-level rows.
02
DNS-layer security
Block malicious, phishing, malware, ransomware, botnet, and newly observed domains before connection, with custom allow and deny lists.
03
Secure Web Gateway
HTTP and HTTPS inspection, acceptable-use enforcement, policy by user, group, device, and location.
04
Cloud-delivered firewall
Layer 3 through Layer 7 filtering by IP, protocol, port, user identity, application, and destination.
05
Cloud app visibility & control
Discover sanctioned and unsanctioned apps, risk-score them, and enforce policy on shadow IT.
06
Advanced threat protection
Global threat intelligence, sandboxing, machine learning, and behavioral analytics.
07
Data protection
DLP monitoring and data-exposure alerting across the protected surface.
08
Remote user protection
On and off network, no VPN required, across Windows, macOS, iOS, and Android.
09
Reporting & analytics
Single admin console, real-time visibility, customizable reports, SIEM and log export, log retention.
10 · The hook
Identity & directory integration
Microsoft Entra ID, Azure AD, Active Directory, RBAC, MFA, policy by user, group, and OU.
11
Integration
RESTful APIs, syslog, SIEM connectors, endpoint and identity-platform integration.
Value & pricing
A lump-sum competition, with one variable that moves the number.
No budget is stated by the city. The ranges below are independent pre-bid estimates derived from scope, not city figures. Platform licensing per user is the key variable, compounded by a user count the RFP does not give.
Low / aggressive
$280k to $320k
Lean platform tier, tight implementation, minimal optional services.
Mid / recommendedBase case
$350k to $420k
Bottom-up estimate lands $345,640 to $411,140 once platform licensing is included. Model under NDA
High / premium
$450k to $550k
Full feature tier, extended training, and managed-service options.
Annual platform licensing runs an estimated $65k to $120k for an assumed 300 to 500 city users. A licensing edge of $30 to $40 per user per year can decide criterion D. The user count is not in the RFP and is worth a question by June 15.
Techtiz back-office pricing is scoped per engagement after NDA and is not part of the public solicitation intelligence.
Frameworks & law
The frameworks and statutes the contract pulls in.
The language municipal security officers expect to see, plus the governing law and codes. NIGP is stated by the city; NAICS is inferred.
Michigan law, Ottawa County venue
Michigan Compiled Laws. Venue in Ottawa County Circuit Court or the Court of Claims, the municipal default.
NIST Cybersecurity Framework
The baseline reference for control posture.
CIS Controls v8
Prioritized safeguards municipal IT maps to.
CISA Zero Trust Maturity Model
The architecture posture a SASE bid should speak to.
SOC 2 Type II & ISO 27001
Required certifications, with FedRAMP if applicable.
Michigan FOIA
Public-records and log-retention duties shape the reporting requirement.
NIGP 920-37
Networking services, including installation, security, and maintenance.
NAICS 541512 / 518210
Computer systems design, with data hosting for the cloud component. Inferred, not city-stated.
Agency context
Who is buying, and who scores it.
The City of Holland is a Michigan municipal corporation in Ottawa County, known as the Tulip City, with a Council-Manager form of government under mayor Nathan Bocks. Procurement runs through the Finance Office. <strong>Lynn McCammon, Finance Director and Purchasing Coordinator,</strong> is the signer and primary submission recipient. <strong>Joe Firmiss, Technology Manager,</strong> is the sole channel for written questions and the likely technical evaluator.
The City of Holland is a Michigan municipal corporation in Ottawa County, known as the Tulip City, with a Council-Manager form of government under mayor Nathan Bocks. Procurement runs through the Finance Office. Lynn McCammon, Finance Director and Purchasing Coordinator, is the signer and primary submission recipient. Joe Firmiss, Technology Manager, is the sole channel for written questions and the likely technical evaluator.
34,378
Residents, 2020 census
Ottawa Co.
Western Michigan
920-37
NIGP networking services
Holland Old City Hall and Fire Station, Holland, Michigan. Photo by Andrew Jameson, CC BY-SA 3.0, via Wikimedia Commons.
The competing field
30 primes mapped, two outliers carry the revenue.
From the prime-contractor database. Two national firms account for most of the combined revenue, but the bench is a long tail of boutiques, and the in-state field is strong. Figures are public-source estimates for partner targeting.
30
Firms mapped to the solicitation
12 / 18
Highly / partially relevant
13
Michigan-based primes
~$64.2B
Combined estimated revenue
8national, $1B+, where the revenue concentrates2mid-market, $100M to $1B20boutique, under $100M
Two outliers, HPE at about $28.5B and CDW Government at about $21.5B, account for roughly $50B of the $64.2B combined. The database summary header is stale, reporting 28 firms and 0 Michigan; the row-level data shows 30 firms and 13 Michigan, which is what this page uses.
The best-fit Michigan targets, Trace3, Logicalis, Presidio, Extreme Networks, Merit Network, Virtual Guardian, and Watchdog Cyber, plus the full named map and relevance scoring, are in the full document pack. Ask us for it under NDA.
The submission
Eight things every proposal must contain.
Each maps to a tab in the response. A Certificate of Insurance is strongly advised because criterion C scores the insurance section.
01Cover letter02Technical proposal mapped to the nine areas03Lump-sum pricing04Service level agreements05Deployment methodology & timeline06Training & knowledge-transfer plan07Security certifications, SOC 2 Type II, ISO 27001, FedRAMP if applicable08Certificate of Insurance+Third-party assessment documentation
Before June 15
Four questions worth filing.
Questions the prime should consider, in writing, through the one channel. Techtiz never contacts the City.
Question 01
What are the required insurance limits?
Criterion C is scored on the insurance section. Limits and required cover shape how it is written.
Question 02
Is there an incumbent, and is this a migration or net-new?
The implementation methodology and timeline change depending on what is being replaced.
Question 03
What is the user and device count?
Licensing is per user, so the count is the single biggest driver of the lump-sum price.
Question 04
Is an electronic-only submission a complete submission?
Confirm the exact sealed-submission mechanics before building the package.
How Techtiz fits
The technical-response engine, behind your firm.
Techtiz drafts the technical content in pre-production. The prime owns the platform decision, the contract, the live systems, and every word said to the City.
NDA before any data
A mutual NDA that names the City and this solicitation, before a single document moves.
Nine sections & the matrix
All nine capability sections and the requirement-by-requirement compliance matrix, drafted for your review.
Architecture & integration
The identity-integration diagram, SLAs, deployment methodology, and training materials, in pre-production.
Your firm owns the contract
Signing, live-system work, instructor-led training, and the City relationship all stay with the prime.
NDA Prime name, engagement value, and city data stay under NDA. Techtiz never contacts the City.
Bidding Ref 0000426310? The window is open.
Request the full RFP-decode pack.
Tender Insight, Statement of Work, Summary of Procurement, the submission-operations guide, and the prime database. A US partner manager replies within one business day, under a mutual NDA, never agency-facing.
Frequently asked questions
Pre-bid brief & confidentiality
Quick answers about how to use this engagement example and what detail is available under NDA.
Why is the prime contractor name withheld?
Most SLED subcontract work sits under mutual NDA and prime branding requirements. Public summaries describe engagement type, technical surface, and outcomes. Partner names and proposal content are shared only with explicit written permission or under an executed teaming agreement.
Can Techtiz support our bid on a similar pursuit?
Yes. If your pursuit matches this engagement type, email sled@techtiz.co or use the teaming intake form. Within 1 business day a U.S.-based partner manager replies with a mutual NDA template and a calendar slot—never agency-facing.
What do we receive under NDA?
Full RFP-decode packs, compliance matrices, technical volumes, submission runbooks, and named-resume options scoped to your vehicle and timeline. Prime name, pricing, and agency data stay inside the prime boundary.
Does Techtiz contact the procuring agency?
No. Techtiz is subcontract-only and never faces the agency. Your program manager holds the client relationship, sign-off, and all agency communication.