IMRF RFP: 2026 LogRhythm/Exabeam Cloud-Native Platform Migration

Description: The Illinois Municipal Retirement Fund (IMRF) is inviting bids for the products and/or services described in the general specifications set forth in this document for migrating an existing on-premises LogRhythm SIEM architecture to the Exabeam New Scale cloud-native Security Operations Platform. The procurement covers licensing SKUs, professional services deployment packages, storage and data retention estimations, and comprehensive training pathways required for a SOC transformation. Project Background: This document provides complete, structured technical and commercial specifications to support the Request for Proposal (RFP) for migrating an existing on-premises LogRhythm SIEM architecture to the cloud-native platform (Exabeam New Scale Security Operations Platform). It outlines recommended migration SKUs (for example: NS-FUSION-US-S, ADDON-LT-SEARCH-US-S), feature and capability parity mapping between on-prem LogRhythm and the New Scale cloud, recommended cloud storage/data lake and retention sizing (including hot search retention and cold archive retention), professional services scope including environment assessment, rule translation, cutover and post-migration stabilization (standard deployment SKU EXA-DEPLOY-STANDARD), and training and certification pathways (TRAINING-SUBSCRIPTION) for administrators and security analysts. General Specifications and Requirements include: the IMRF email of record for the purchase after award; quote validity for a minimum of 60 days; sales tax exemption and tax exemption certificate information; requirement that bids include the bid specification cost sheet and a completed Verification of Minority/Disabled/Woman Owned Business Status (Exhibit B); equipment must be new and eligible for manufacturer warranty; delivery terms (F.O.B. inside delivery to 800 Commerce Drive, Oak Brook, IL 60523) with freight included in unit price; bid evaluation and award procedures (IMRF may award to other than the lowest bidder or reject all bids); and various administrative, insurance, confidentiality, security breach, indemnity, and legal provisions. Project Summary details the Functional & Operational Licensing Changes (metric transition to GB/day and active identities, add-ons included in base SaaS, direct cloud API connectors), Ingestion Sizing Recommendation (sized for peak daily volume plus growth buffer), Active Hot Search Retention (365 days recommended, with 30 days included), Cold Archive Retention (add-on sold in years 2 and 3), Professional Services deliverables (kickoff, architecture, environment assessment, rule translation, dashboards/reports recreation, parallel run/UAT, cutover, hypercare), and Training & Educational Pathways (administrator and analyst training formats, course catalogs and certification pathways). The document includes a three-year term product summary with example SKUs and term dates, and requires respondents to acknowledge receipt and acceptance of Addendum #1 (dated Nov. 2, 2026) by signing and submitting the signed addendum with the proposal. Additional administrative provisions include IMRF governance/board oversight, purchasing diversity policy and verification requirements, open records/open meetings compliance, payment procedures, and standard terms and conditions governing warranties, termination, nondiscrimination, insurance, security breach notification, and indemnity.