RFI SolarWinds ARM Implementation 2026

Request for Information (RFI) #1412188079:
(Solarwinds ARM Implementation 2026)

RFI #1412188079: Solarwinds ARM Implementation 2026
1 INTRODUCTION AND PURPOSE OF THE RFI
With this RFI we request information regarding your company and your products/services. The same
information will be gathered from different companies to learn available service delivery options for a
Solarwinds ARM Implementation. This RFI is for informational and planning purposes and is not to
be construed as solicitation or a commitment to issue a solicitation.
General
Charter Article I, Section 24, Florida Constitution, guarantees every person access to all public
records and Chapter 119, Florida Statutes, provide a broad definition of public records. JEA is a
body politic, corporate, and subject to these laws and related statutes ("Florida's Public Records
Laws"). All responses to this RFI are public records and available for public inspection unless
specifically exempt by law.
IF A PROPOSER HAS QUESTIONS REGARDING THE
APPLICATION OF CHAPTER 119, FLORIDA STATUTES, TO THE
CONTRACTORS DUTY TO PROVIDE PUBLIC RECORDS
RELATING TO THIS CONTRACT, CONTACT THE CUSTODIAN OF
PUBLIC RECORDS AT:
JEA
Attn: Public Records
225 N Pearl Street
Jacksonville, Florida 32202
Ph: 904-665-8606
publicrecords@jea.com
Redacted Submissions
If a Proposer believes that any portion of the documents, data or records submitted in response
to this RFI are exempt from Florida's Public Records Law, Proposer must (1) clearly segregate
and mark the specific sections of the document, data or records as "Confidential," (2) cite the
specific Florida Statute or other legal authority for the asserted exemption, and (3) provide JEA
with a separate redacted copy of its response (the "Redacted Copy"). The cover of the Redacted
Copy shall contain JEA's title and number for this RFI and Respondent's name, and shall be
clearly titled "Redacted Copy." Respondent should only redact those portions of records that
Proposer claims are specifically exempt from disclosure under Florida's Public Records Laws. If
Respondent fails to submit a redacted copy of information it claims is confidential, JEA is
authorized to produce all documents, data and other records submitted to JEA in answer to a
public records request for such information.
In the event of a request for public records to which documents that are marked as confidential
are responsive, JEA will provide the Redacted Copy to the requestor. If a requestor asserts a
right to any redacted information, JEA will notify Respondent that such an assertion has been
made. It is Respondent's responsibility to respond to the requestor to assert that the information
in question is exempt from disclosure under applicable law. If JEA becomes subject to a demand
for discovery or disclosure of Respondent's redacted information under legal process, JEA shall
give Respondent prompt notice of the demand prior to releasing the information (unless otherwise
prohibited by applicable law.) Respondent shall be responsible for defending its determination
that the redacted portions of its response are not subject to disclosure.
By submitting a response to this RFI, Respondent agrees to protect, defend and indemnify JEA
from and against all claims, demands, actions, suits, damages, liabilities, losses, settlements,
6/29/2026
Page 3 of 9

RFI #1412188079: Solarwinds ARM Implementation 2026
costs and expenses (including but not limited to reasonable attorney fees and costs) arising from
or relating to Respondent's determination that the redacted portions of its response to this
Solicitation are not subject to disclosure.
2 BACKGROUND, SCOPE, AND SOLUTION OPTIONS
2.1 Background
JEA owns, operates and manages the electric system established by the City of Jacksonville, Florida in
1895. In June 1997, JEA also assumed operation of the water and sewer system previously managed by
the City. JEA is Florida's largest municipally owned utility and the seventh largest municipal in the United
States.
2.2 Scope
JEA is seeking information from vendors regarding their capabilities, methodologies, and recommended
approaches for implementing SolarWinds Access Rights Manager (ARM) within an onpremises
enterprise environment. JEA's primary objectives include improving visibility into Active Directory (AD)
permissions, enhancing file server access auditing, enabling structured access reviews, and establishing
governance processes that support security, audit, and compliance requirements.
Respondents should provide information on their ability to support activities such as requirements
gathering, ARM installation and configuration, integration with AD and file servers, permissions scanning,
changetracking, reporting, and the development of operational documentation and training. Vendors are
also invited to describe bestpractice approaches for permission governance, leastprivilege enforcement,
data owner workflows, and longterm sustainability of an ARM deployment.
2.3 Solution Option
JEA is seeking information on available solution approaches and implementation methodologies that
vendors offer to support deployment of SolarWinds Access Rights Manager (ARM) in an onpremises
environment. Respondents are invited to outline how their proposed solution would address JEA's
objectives, including AD and file server permissions visibility, access review workflows, changetracking,
reporting, training, and ongoing support.
Vendors should describe standard ARM implementation options, recommended deployment
architectures, configuration approaches, integration capabilities, and any best practices that support
security, audit, and compliance requirements. Respondents may also provide optional features, addon
capabilities, or enhancements that could help strengthen access governance, improve permission
hygiene, or streamline identity and access management processes.
3 GENERAL INSTRUCTIONS
Please note that this RFI is issued solely for the purpose of obtaining information. Nothing in this RFI
shall be interpreted as a commitment on the part of JEA to enter into a contract with any respondent
thereof to make any procurement. JEA reserves the right to invite any of the RFI respondents to do a
follow up presentation as part of the RFI process.
3.1 Response Instructions
3.1.1 Response Submission
All responses to this RFI are due no later than two weeks upon being submitted.
Respondents should submit an electronic copy via the Zycus system. All responses must
include on the first page the official name of the firm or entity submitting the response.
Please consecutively number all pages of the response.
6/29/2026
Page 4 of 9

RFI #1412188079: Solarwinds ARM Implementation 2026
3.1.2 Response Content
Vendors shall include a response to Appendix A, and to each of the questions set forth
under Question and Vendor Responses (Section 5) of this RFI. Vendors should
elaborate how or why they meet the functionalities in which measurement or quantifiable
in the comment section next to each requirement.
3.1.3 Response Format
JEA requests that all responses be submitted with a point-by-point response to each
question in every section. If a respondent opts not to respond to any item(s) please
include an explanation for the lack of response.
3.2 Contacts
3.2.1 Questions
Potential respondents who have questions regarding this RFI may email them to:
garljb@jea.com by 7/2/26. Respondents may only make inquiries and request
clarification concerning this RFI by written questions via e-mail. Responses to inquiries
and clarification questions will be provided electronically to all interested parties.
3.2.2 Contact Information
Please direct all communications, questions, and responses to the following contact:
Brooke Garland, Purchasing Agent
JEA
225 N Pearl Street,
Jacksonville, FL 32202
E-mail: garljb@jea.com
3.3 Timeframe
CALENDAR EVENT DATE TIME
RFI Posting and Release 6/24/26 3:00pm
Questions Due 7/2/26 12:00noon
RFI Responses Due 7/9/26 12:00noon
4 ADDITIONAL INFORMATION
4.1 Requests for Additional Information
JEA retains the right to request additional information from respondents.
4.2 Cost Incurred
By submitting a response, respondents agree that any cost incurred in responding to this RFI, or
in support of activities associated with this RFI, shall be the sole responsibility of respondent.
JEA shall not be held responsible for any costs incurred by respondents in preparing their
respective responses to this RFI.
4.3 Review Rights
Responses to this RFI may be reviewed and evaluated by any person(s) at the discretion of the
JEA, including independent consultants retained now or in the future. JEA reserves the right to
request a demonstration from one or more companies.
4.4 Public Record
All responses to this RFI will be public record under the State of Florida's Sunshine Law
regardless of confidentiality notices set forth on such writings to the contrary.
6/29/2026
Page 5 of 9

RFI #1412188079: Solarwinds ARM Implementation 2026
5 QUESTIONS AND VENDOR RESPONSES
See General Instructions in Section 3 for information on response format and submission. Note: Please
describe any assumptions you make in answering these questions as part of each response.
5.1 Questions / Vendor Responses
5.1.1 Company Information
1. Company name, mailing address, phone number, fax number, and phone/e-mail of designated
point of contact for RFI.
2. Corporate web site address.
3. Number years on the market.
4. Company location(s).
5.1.2 Overview of Customer Base
1. Identify two (2) client reference based on similar solution(s). Include the client name, point of
contact information, and government contract number (if applicable).
5.1.3 Business Model Overview
Please provide an overview of your company's business model as it relates to the delivery of enterprise
implementation services. Describe how your organization structures engagements for onpremises
software deployments such as SolarWinds Access Rights Manager (ARM). This should include your
approach to service delivery, project management practices, delivery staffing model, quality assurance
approach, and methods used to ensure successful completion of technical implementation projects.
Vendors should also include information on how ARM implementation services are packaged (e.g.,
fixedfee, milestonebased, timeandmaterials), how scope is managed throughout the engagement, and
how risks, assumptions, issues, and dependencies are typically handled through the lifecycle of similar
projects.
5.1.4 Business Process, Integration, and Functionality
a) ARM Functional Capabilities
Provide information on how your solution supports:
* Active Directory (AD) permissions visibility, including accounts, groups, inheritance, and
privileged rights
* File server NTFS/share permissions scanning, inheritance analysis, and access path mapping
* Scheduled scanning of AD and file servers to ensure current and accurate permission data
* Reporting and dashboard capabilities aligned to InfoSec, Internal Audit, and business/data owner
requirements
* Changetracking functionality for permission updates, group membership changes, and privilege
elevation events
* Access review (recertification) workflows, routing, notifications, and business owner engagement
b) Integration Requirements
Describe your experience integrating ARM (or a comparable solution) with:
* Onpremises Active Directory environments
* Windowsbased file servers and associated repositories
* Optional export methods such as CSV, scheduled report exports, or APIbased outputs
* Please include any limitations, additional integrations you commonly support, or prerequisites for
connectivity.
c) Deployment & Technical Architecture
Provide information or a high-level deployment diagrams about how your proposed architecture supports:
* Onpremises deployment of ARM components (no cloud/SaaS required unless explicitly approved)
* Deployment on Windows Server in accordance with customer standards
6/29/2026
Page 6 of 9

RFI #1412188079: Solarwinds ARM Implementation 2026
* Rolebased access controls for system administrators, InfoSec personnel, and reviewers
* Scalability to additional AD domains, future file servers, or expanded governance requirements
* Secure data handling ensuring that permission data, logs, and changetracking events remain within
the customer network boundary
d) Business Processes & Governance
Describe recommended business processes and governance practices your organization supports or
implements, including:
* Permission cleanup and remediation strategies
* Group and entitlement management improvements
* Delegation models for business/data owners
* Leastprivilege enforcement methodologies
* Best practices for aligning ARM capabilities with audit and compliance needs
e) Validation & Quality Assurance
Explain your approach to ensuring accurate and complete permission data, including:
* Scan validation processes & how scan accuracy can be confirmed prior to go-live.
* Troubleshooting inaccessible repositories or inconsistent ACL data
* Resolving AD or file server integration issues
* FitGap analysis methodologies used to align ARM functionality with customer requirements
f) Mandatory Demonstration Requirement
Respondents are required to provide a demonstration of their SolarWinds Access Rights Manager (ARM)
implementation capabilities. Demonstrations must show the respondent's ability to perform Active
Directory (AD) and file server scanning, permissions visualization, reporting, changetracking events, and
access review workflows. Respondents must also demonstrate their configuration methodology,
alignment with onpremises deployment requirements, and ability to export reports or datasets as
needed.
5.1.5 Implementation
a) Project Approach
* Outline your process for requirements gathering, currentstate assessment, and project planning.
b) Installation & Configuration
* Summarize how you install and configure ARM in an onpremises Windows Server environment,
establish AD and file server connectivity, configure collectors and scheduled scans, and align with
customer security requirements.
c) Functional Setup
* Describe how you configure AD/file server scanning, permission needs, reporting dashboards,
changetracking rules, and access review workflows for business/data owners.
d) Testing
* Provide an overview of your testing approach, including validation of scans, reporting, workflows,
and support for User Acceptance Testing.
e) Deployment & GoLive
* Explain your cutover, production migration, and postgolive stabilization process, including typical
implementation timelines.
f) OnPremises Requirement
* Confirm your ability to deploy ARM without reliance on vendorhosted cloud components.
6/29/2026
Page 7 of 9

RFI #1412188079: Solarwinds ARM Implementation 2026
5.1.6 Maintenance Support & Consulting
a) PostImplementation Support
* Summarize the support you provide during system stabilization, including issue resolution,
configuration tuning, and knowledge transfer.
b) Ongoing Support Model
* Describe your standard support structure (e.g., escalation paths, response times, SLAs) for ARM
or comparable access governance solutions.
c) Upgrade & Maintenance Approach
* Explain your approach for managing ARM upgrades, including expected customer actions,
downtime expectations, version compatibility considerations, and any associated costs.
d) Optional Consulting Services
* Outline any additional consulting offerings that support continuous improvement of access
governance processes or ARM optimization.
5.1.7 Training Documentation, and Support
a) Training Approach
* Summarize the training you provide for system administrators, InfoSec users, and business/data
owners, including delivery format (e.g., virtual, onsite) and typical duration.
b) Documentation
* Describe the types of documentation you make available, such as user guides, quickreference
materials, operational runbooks, and administrator procedures.
c) Support During Adoption
* Outline how you support customers during user onboarding and initial operation of ARM,
including any guidance you provide for business owners involved in access reviews.
5.1.8 Solution Security
1. All cloud based solution shall require documentation that demonstrates SOC Type 2, ISO 27001,
or other relevant security related assessment compliance. (An auditor's report or independent
third party assessment report will be required annually).
2. For your cloud based solution, a declaration that Company data shall only be stored within the
Continental United States will be required.
5.2 Budgetary Cost Estimates
Cost estimates have been requested for budgetary purposes only and should be based upon the
parameters defined within this document.
1. Please provide an estimated price for the product/application. Unlimited users are expected
to use the proposed solution.
2. Please provide the type of licenses required (End User, Support, etc.), and aggregated cost
for each license
3. Please provide the estimated price for the licensing (annual costs as well as estimated
renewal costs over a five (5) year period).
4. Please provide a cost estimate for your implementation services - identifying both required
and optional services with pricing. Estimates should be categorized (planning, analysis,
design, construction, testing, production deployment, post go live support, travel, training,
etc.) and include all potential charges. If price ranges are used please specify what is
provided at each end of the range.
5. Include the time to implement your services as well as the roles and responsibilities of the
human resources who will be a part of the implementation team.
6. Please provide a cost estimate for annual support and maintenance
6/29/2026
Page 8 of 9

RFI #1412188079: Solarwinds ARM Implementation 2026
6/29/2026
Page 9 of 9