1-RFP25-26-02 Incident Response Disaster Recovery.pdf

REQUEST FOR PROPOSALS

FOR

RFP-25/26-02

INCIDENT RESPONSE (IR) & DISASTER RECOVERY (DR) PLANS

FOR THE DISTRICT’S OPERATIONAL TECHNOLOGY (OT) ENVIRONMENT

Issued by:

Audrey Stenerson, Senior Buyer

Procurement & Contracts Division Alameda County Water District

43885 South Grimmer Boulevard Fremont, CA 94538

Tel.: (510) 668-4291

Page | 1

TABLE OF CONTENTS

Page

1.. INFORMATION / INSTRUCTIONS TO PROPOSERS

1.1. INVITATION

1.2. PERIOD OF PERFORMANCE

1.3. BACKGROUND

1.4. DEFINITIONS

1.5. SOLICITATION TIMELINE

1.6. VENDOR REGISTRATION

1.7. EXAMINATION OF RFP DOCUMENTS

1.8. PRE-PROPOSAL MEETING

1.9. QUESTIONS AND REQUESTS FOR CLARIFICATIONS

1.10. ACKNOWLEDGEMENT OF ADDENDUM / ADDENDA TO THE SOLICITATION

1.11. BASIS OF AWARD

1.12. EVALUATION OF PROPOSALS

1.13. EVALUATION CRITERIA

1.14. DISTRICT’S RIGHTS

1.15. SUBMISSION OF PROPOSALS

1.16. PERIOD FOR ACCEPTANCE OF PROPOSALS

1.17. MODIFICATION, WITHDRAWAL, MISTAKES, AND MINOR INFORMALITIES

1.18. EX-PARTE COMMUNICATIONS

1.19. CONFIDENTIALITY

2.. SCOPE OF SERVICES AND SPECIAL PROVISIONS

2.1. PURPOSE AND BACKGROUND

2.2. PROPOSER’S QUALIFICATIONS AND EXPERIENCE

2.3. SCOPE OF SERVICES

2.4. ACCOUNT MANAGER & ESCALATION MATRIX

3.. PROPOSAL CONTENT AND SUBMITTAL

3.1. PROPOSAL CONTENT

3.2. PROPOSAL SUBMITTAL

4.. APPENDICES

Page | 2

1. INFORMATION / INSTRUCTIONS TO PROPOSERS

1.1. INVITATION

The Alameda County Water District (District) invites qualified firms to submit proposals to provide Incident Response and Disaster Recovery Plans to allow District Staff to respond and recover from incidents which impact the Operations Technology Environment.

1.2. PERIOD OF PERFORMANCE

It is the intent of the District to award an Agreement to the highest ranked Proposer, in accordance with the evaluation criteria set forth herein.

1.3. BACKGROUND

The District is a California Special District located in the San Francisco Bay Area. For 100 years, the District has supplied water to the residents and businesses of southern Alameda County. The area has grown and changed from being an important agricultural center to supporting a growing suburban population, the water system has grown and changed with it.

Today, the District has a staff of nearly 240 dedicated employees and supplies drinking water to the more than 348,000 people living in the cities of Fremont, Newark, and Union City. It is the mission of the District to provide a reliable supply of high-quality water at a reasonable price to our customers.

1.4. DEFINITIONS

Whenever the following words occur in this Request for Proposal (RFP), they shall have the following meanings:

EUNA PROCUREMENT shall mean the District’s E-Procurement System

COMPETITIVE SEALED PROPOSALS is a transparent procurement method in which Proposals from competing contractors, suppliers, or vendors are invited by openly advertising the scope, specifications, and terms and conditions of the proposed Agreement. Award is typically made to the most qualified Proposer or Proposers whose Proposal(s) provides the best value to the District.

CONTRACT ADMINISTRATOR shall mean the District’s Contract Administrator who will be identified after Solicitation award. Any reference to the Contract Administrator in the Agreement shall mean the Contract Administrator or designated representative. The Agreement will be performed under the direction, inspection and supervision of the Contract Administrator.

CONTRACTOR or CONSULTANT means any person or firm having a Contract with the District.

DISTRICT or ACWD shall mean the Alameda County Water District.

PROPOSER means a corporate entity or individual who responds to this Request for Proposals.

Page | 3

REQUEST FOR PROPOSALS or RFP means all documents, whether attached or incorporated by reference, utilized for soliciting Proposals; also referred to as “Solicitation.”

SERVICES shall mean the requested services, goods, supplies or equipment.

1.5. SOLICITATION TIMELINE

The District intends to adhere to the following anticipated timeline:

1.6. VENDOR REGISTRATION

Please go to the District’s E-Procurement System, Euna Procurement at https://acwd.bonfirehub.com to register, if you have not already done so. Future solicitation announcements will be sent via the District’s E-Procurement System, Euna Procurement at https://acwd.bonfirehub.com to those vendors who have registered.

1.7. EXAMINATION OF RFP DOCUMENTS

The selected Proposer will be required to execute an Agreement for Services, refer to sample located in Appendix B, with the District, describing the Scope of Services to be performed, compensation, insurance requirements and other pertinent provisions.

Before submitting its Proposal, each Proposer must (a) examine the RFP documents thoroughly and (b) familiarize itself with any applicable Federal, State and local laws, ordinances, rules and regulations, and standards affecting provision of the Services.

1.8. PRE-PROPOSAL MEETING

Proposers are invited to attend a Pre-Proposal meeting remotely, via Teams. at the date and time specified in Section 1.5. Attendance is not mandatory but strongly recommended. Due to the sensitive information within this solicitation, it is required for all attendees of the pre-proposal meeting to complete Appendix C, Non-Disclosure Agreement. Upon receipt of the agreement signed for all attendees, instructions to attend the meeting electronically will be provided. Send your request for the Non-Disclosure Agreement to Audrey Stenerson, Senior Buyer, Date of Issuance: September 3, 2025

Pre-Proposal Meeting: September 11, 2025 Questions & Requests for Clarifications Due: by 3:00 P.M. PST September 18, 2025

Addendum Issued September 23, 2025

Proposals Due by 3pm PST: September 30, 2025

Consultant Interviews, if held: October 16th and 17th, 2025

Anticipated Award Date November 2025

Page | 4 audrey.stenerson@acwd.com two days prior to the scheduled meeting to allow time for all signatures to be completed.

The meeting shall consist of a review of the solicitation process, requested services and required proposal submittals. The meeting is anticipated to take up to One (1) hour.

1.9. QUESTIONS AND REQUESTS FOR CLARIFICATIONS

Prospective Proposers must carefully examine the Solicitation documents, including terms and conditions of the Agreement. In the event of doubt of anything contained in the Solicitation, all questions or requests for clarification about the meaning or intent, discrepancies or omissions of the RFP documents may be submitted in writing to Audrey Stenerson Procurement & Contracts Division, via the District’s E-Procurement System, Euna Procurement at https://acwd.bonfirehub.com until the date and time specified in Section 1.5.

Responses to questions and requests for clarification will be posted in the form of an addendum via the District’s E-Procurement System, Euna Procurement at https://acwd.bonfirehub.com no later than the date and time specified in Section 1.5. Only questions answered in a formal written response will be binding. Oral and other interpretations or clarifications will be without legal effect. Any information given to a prospective Proposer by the District will be furnished to all prospective Proposers, if that information is necessary in submitting Proposals, or if the lack of such information would be prejudicial to other prospective Proposers. Bidders are responsible for checking the District’s E-Procurement System, Euna Procurement, at https://acwd.bonfirehub.com for any addenda. The District makes no guarantee that any questions submitted after the deadline will be answered.

1.10. ACKNOWLEDGEMENT OF ADDENDUM / ADDENDA TO THE SOLICITATION

Each Proposer shall acknowledge receipt of any addendum / addenda to this Solicitation via the District’s E-Procurement System, Euna Procurement at https://acwd.bonfirehub.com Proposers are required to submit the signature page of each addendum, if any, with their Proposal.

1.11. BASIS OF AWARD

It is the intent of the District to award an Agreement for Services (Agreement) to the highest ranked Proposer, in accordance with the evaluation criteria set forth in Section 1.13 “Evaluation Criteria.” In the event a mutually satisfactory Contract cannot be negotiated with the highest ranked Proposer, negotiations may be terminated by the District and commenced with the next highest ranked Proposer.

1.12. EVALUATION OF PROPOSALS

Proposals will be screened to ensure responsiveness to the requirements of the RFP. The District reserves the right to request additional information and clarifications during the evaluation and selection process from any or all Proposers regarding their proposals.

Page | 5

· Technical Evaluation Team

A Technical Evaluation Team (TET), which is composed of District staff, or other qualified persons, will review and screen the proposals submitted according to the weighted criteria and process indicated in Section 1.13, Evaluation Criteria below. While price is one basic determinant for award, it is not the sole consideration. The TET's composite scores for all steps of the evaluation process will comprise the official record for the proposal evaluation process;

individual evaluation records will not be available for public inspection at any point during or after the evaluation process.

· Interviews and Presentations

Following the initial review and evaluation of proposals, some Proposers may be invited to participate in the next step of the proposal selection process. This may include the submission of additional information, as described below, and/or participation in an oral interview. If the District conducts interviews, they will do so only with those Proposers initially found to be within the “competitive range”. Interviews, if held, are tentatively scheduled on the date and time specified in Section 1.5 and will be held at the District’s Headquarters, located at 43885 South Grimmer Blvd., Fremont, CA 94538.

The District reserves the right to further reduce the “competitive range” at any time during this step of the evaluation and selection process and the District may hold simultaneous discussions with those Proposers that remain in the “competitive range.” Proposers who are no longer in the “competitive range” will be notified as soon as it is practicable and will not continue in the selection and evaluation process.

· References

Proposers are required to submit references of three (3) clients (preferably public sector clients in California) for similar services during a five (5) year period. For each client submitted as a reference, Proposers shall supply a brief description of the services provided, the timeframe services were provided, and client contact information. All references will be contacted by a District Designee via e-mail, fax, or telephone call to obtain answers to questions, as applicable, before an evaluation decision is made.

1.13. EVALUATION CRITERIA

The maximum possible total combined score for a proposal is 100 points.

· Methodology and Approach to Scope of Services Maximum Points 40 points

The Proposer’s responsiveness, overall methodology and approach to successfully providing the Scope of Services will be evaluated. Proposals will be evaluated on, but not limited to:

o Proposer’s understanding of the Scope of Services as demonstrated through clear and concise articulation of criteria required to complete the work.

o Proposer’s completeness, clarity, detail and methodology to RFP scope of work, Page | 6 o Demonstrated knowledge of the work to be completed, o Inclusion and completeness of requested forms (e.g. exceptions to solicitation documents, resumes of project team, furnished proposal forms [properly signed and executed], completed contact information for references provided.)

o Proposer’s preliminary schedule and approach for completing the scope of work.

o Strategies proposed to meet project goals and to deliver the project on time and identification of opportunities and challenges to achieving project delivery in a timely manner will be reviewed.

o The scope, quality, and feasibility of Proposer’s work plan.

· Task Examples Maximum Points 15 points o Short examples (5 pages or less) of customer redacted Incident Response, Disaster Recovery, and Runbook in an effort to show the structure and detail proposed.

· Qualifications and Experience of Company Maximum Points 20 points

The capabilities of each Proposer will be assessed on:

o Company's qualifications and experience in providing the specified services for similar operations and/or entities.

o Public sector and or Water Utility Agency experience.

o The Proposer’s commitment of key personnel who will be involved with each major task element of the project and qualified staff to provide required services to complete the project in a timely and cost-effective manner. The appropriateness of the labor classifications assigned to each task.

o Availability of designated staff, consultants/account representative(s) and other team members assigned to work with the District.

o Proposer’s experience in carrying out the project of this type, demonstrated by the past five

(5) years of experience.

o Proposer’s demonstrated capacity, facilities and organizational structure to perform the type of services sought in this RFP.

· Level of Effort Maximum Points 15 points

The Consultant’s estimated personnel hours expected to be spent on each task element including each member of the consulting firm and all subconsultants/contractors will be reviewed.

· Cost Proposal Maximum Points 10 points

The proposer submitting the lowest priced cost receives the maximum points allowed. All other proposals receive a percentage of points available based on their cost relationship to the lowest. This is determined by applying the following formula:

Page | 7

𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐿 𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶

𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶 𝐵𝐵𝐵𝐵𝐵𝐵𝐵𝐵𝐵𝐵 𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸

× 𝑀𝑀𝑀𝑀𝑀𝑀𝑀𝑀𝑀𝑀𝑀𝑀𝑀𝑀 𝑃𝑃𝑃𝑃𝑃𝑃𝑃𝑃𝑃𝑃𝑃𝑃 𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴 = 𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴 𝑃𝑃𝑃𝑃𝑃𝑃𝑃𝑃𝑃𝑃𝑃𝑃

Total Possible Points for this RFP = 100

Example:

The cost of the lowest proposal is $10,000. The next lowest proposal has a cost of $12,500;

the total number of points available for cost is 30 points. ($10,000

$12,500 ) 𝑥𝑥 30 = 24 𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝 𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎

1.14. DISTRICT’S RIGHTS

The District reserves the right to do any of the following at any point during the solicitation process:

· To cancel this solicitation in whole or in part, at its sole discretion, at any time,

· This RFP does not commit the District to award an Agreement, to pay any costs incurred by

Proposers in the preparation of their proposals submitted in response to this RFP,

· To procure or contract for services.

· The District reserves the right to modify or cancel in whole or in part this RFP,

· To reject any and all proposals,

· To accept the proposal, it considers most favorable to the District’s interest at its sole discretion,

· To waive irregularities or informalities in any proposal or in the proposal procedures.

· Reserve the right to reject all proposals and seek new proposals when the District considers such a procedure to be in its best interest. If there is any evidence indicating that two or more Proposers are in collusion to restrict competition or are otherwise engaged in anti-competitive practices, the proposals of all such Proposers shall be rejected, and such evidence may be a cause for disqualification of the participants in any future solicitations issued by the District.

· To hold discussions and/or negotiations with any individual or qualified firm,

· To interview or not, to request additional information or revised proposals or to request best and final offers (BAFO) if it is in the best interest of the District to do so.

· To may make an award without conducting any interviews or negotiations; therefore, Proposers are encouraged to submit their best proposal at the outset.

1.15. SUBMISSION OF PROPOSALS

The Proposer shall assume full responsibility for timely delivery for receipt of Proposals. Each Proposer shall submit a Proposal via the District’s E-Procurement System, Euna Procurement at https://acwd.bonfirehub.com before the posted deadline. All required documents must be completed in full.

Page | 8

Proposers shall comply with all instructions in the RFP and must include Proposer’s name, contact number, address, email address.

Completed proposal forms and required attachments shall be submitted via the District’s E- Procurement System, Euna Procurement at https://acwd.bonfirehub.com. Any bid submissions not submitted to the District’s E-Procurement System listed shall not be considered.

No other method of submission, other than those specified herein, shall be considered.

The only acceptable evidence to establish the time of receipt is the time/date stamp provided by the District’s E-Procurement System and maintained by the Procurement & Contracts Division.

Any Proposal received after the deadline for receipt will not be opened and considered for evaluation. However, an exception may be made when a late Proposal would have been timely but for the action or inaction of District.

1.16. PERIOD FOR ACCEPTANCE OF PROPOSALS

In order to allow for adequate evaluation, the District requires a response to this Solicitation to be valid and irrevocable for 90 calendar days after submittal date and time.

Should there be valid reasons why the Agreement cannot be awarded within the specific period;

the time may be extended by mutual agreement between the District and the Proposer.

1.17. MODIFICATION, WITHDRAWAL, MISTAKES, AND MINOR INFORMALITIES

· Modification or Withdrawal o Proposals may be modified or withdrawn prior to the established due date via the District’s E-Procurement System, Euna Procurement at https://acwd.bonfirehub.com.in a form and manner that complies with the requirements set forth in this RFP.

o No Proposer may withdraw a Proposal after the Proposal Due Date.

o At no time shall the highest ranked proposal be withdrawn.

· Mistakes in Proposals (Discovered Before Due Date) o Mistake on the part of the Proposer in preparing the Proposal confers no right for the withdrawal of the Proposal after it has been opened o A Proposer may correct mistakes in a Proposal prior to the time and date set for due date by submitting a replacement Proposal via the District’s E-Procurement System, Euna Procurement at https://acwd.bonfirehub.com, in a form and manner that complies with the requirements set forth in this RFP.

1.18. EX-PARTE COMMUNICATIONS

There shall be no communication with any officer, director, employee, or agent of the District.

Proposers and Proposers’ representatives must communicate in the manner set forth in this RFP.

Page | 9

Nothing herein prohibits Proposers and their representatives from making oral statements or presentations in public to one or more representatives of the District during a public meeting.

1.19. CONFIDENTIALITY

The District will require the execution of Appendix C Non-Disclosure Agreement, for proposing firm and any subcontractors, before Appendix D site locations & infrastructure will be released.

All responses to this RFP become property of ACWD and will be kept confidential until a recommendation for award of a contract has been announced. Thereafter, submittals are subject to public inspection and disclosure under the California Public Records Act (Cal. Govt. Code Sections 7920 et seq.) Therefore, unless the information is exempt from disclosure by law, the content of any proposal, request for explanation, exception, or substitution, response to these specifications, protest, or any other written communication between ACWD and any Consultant regarding the procurement, shall be available to the public. Proprietary information should be clearly identified so that it may be kept confidential. All other parts of the proposal are public records after the recommendation for award of a contract has been announced.

2. SCOPE OF SERVICES AND SPECIAL PROVISIONS

2.1. PURPOSE AND BACKGROUND

The Alameda County Water District (District) invites qualified firms to submit proposals to provide consulting services to help develop Incident Response and Disaster Recovery Plans, including technical Run Books, which will guide and provide actionable information for District Staff to respond to and recover from incidents which impact the Operational Technology (OT) environment.

The District owns and operates a variety of facilities to supply, produce, treat, and distribute water to its customers throughout the cities of Fremont, Newark, and Union City (the District’s service area).

These facilities include raw water diversion, groundwater recharge, water wells, water treatment and production plants, SFPUC take-off facilities, water storage facilities, booster stations, and pressure-regulating stations. These facilities operate on a 24/7 basis and depend upon the ability to recover from incidents and disasters.

To support these facilities, the District owns and maintains a non-internet connected OT environment which is an architecture comprised of various hardware and software including servers, storage equipment, networking equipment, communication systems, and various software applications used to monitor, control, and automate physical devices and processes within industrial control system to support both specific and general purposes in function. The OT infrastructure is located across six facilities throughout the District’s service area. A wide area network (WAN), shared with District IT/Business functions, provides connectivity across these multiple facilities. The OT infrastructure supports critical operations and industrial process controls including Supervisory Control and Data Acquisition (SCADA) HMI applications, Programmable Logic Controllers (PLCs), databases, SQL

Page | 10 server reporting services, and data historian for the District’s water supply, production, treatment, and distribution activities.

2.2. GOALS AND OBJECTIVES

The District’s goal is to establish an OT Incident Response (IR) plan and Disaster Recovery (DR) plan, to prepare and respond appropriately to cybersecurity incidents, physical incidents, and loss of site due to fire, etc. within an OT infrastructure, in accordance with the latest Cybersecurity framework standards and industry best practices.

The Proposer shall ensure available resources, as necessary, to facilitate work in a timely fashion.

To meet the goals of this RFP, the Proposer’s primary objectives are to help the District:

· Understand the District’s existing technology and architecture specifically to the OT system

· Execute the scope of services as defined herein

· Meet the established schedule

· Follow Cybersecurity best practices and standards

· Mitigate unnecessary downtime of existing processes and operations

2.3. PROPOSER’S QUALIFICATIONS AND EXPERIENCE

A. Technical Skill Requirements

Work under this agreement shall be performed by qualified personnel with diverse expertise, technology skills, and past experiences who have previously developed plans similar in scope and complexity as outlined in this RFP. The OT infrastructure has a suite of existing hardware and software platforms as described in Appendix D which will be released upon execution of Non-Disclosure Agreement (See Appendix C) for release of confidential documents/information for request for proposal.

B. Experience

The Proposer shall be fully experienced and properly qualified, licensed, equipped, organized, and financed to perform the work specified and required. All work shall be performed by qualified personnel who have a minimum of five (5) years of experience implementing the type of work being requested in the RFP.

C. Key Personnel and Qualifications

Page | 11

The Proposer shall identify the Project Manager and senior level Quality Assurance / Quality Control (QA/QC) Manager. Provide a short narrative of each team member’s experience that will demonstrate his/her ability to successfully complete the professional services described in the RFP. Copies of resumes of individuals who will be performing the work, including licenses and certifications, shall be provided to the District.

List proposed subconsultants or subcontractors, and describe their expertise, qualifications, and anticipated roles in the Project. State the specific duties and pertinent experience of the subconsultants, including all licenses and certifications. Resumes of all proposed subconsultant’s team members, including license and certifications, shall be included in the Proposal.

Modification to the Project Team, including substitutions and/or additions of key personnel including subconsultants or subcontractors not identified in the proposal, will not be allowed without prior approval by the District.

D. Project References

· Provide statement of qualifications with a brief listing of company experience focusing on work similar in scope to this RFP.

· Provide a list of three (3) projects within the past five (5) years that demonstrate the Consultant’s competence to perform the work required in the RFP. For each reference project, provide the following information:

o Name and location of project.

o Approximate month and year when each project were performed.

o A description of type and extent of services provided.

o Name and address of project owner.

o Name and current phone number of owner’s representative intimately familiar with the project to contact for reference. Verify that the reference person can be contacted at the phone number provided.

o Applicability and relevance to the services required by the District.

· Reference Appendix D for Site locations & Infrastructure which will be furnished by the District upon completion of Non-Disclosure Agreement included in Appendix C for Proposer and any subconsultants/subcontractors that may be hired.

2.4. SCOPE OF SERVICES

The District’s goal is to develop Incident Response and Disaster Recovery Plans, including technical Run Books, which will guide and provide actionable information for District Staff, to respond to and recover from incidents which impact the OT environment. The incidents to be planned for may involve cyber or physical in nature.

The scope of services described below lists the activities and deliverables anticipated by the District to meet the project goal. It is the District’s expectation that the Consultant will use their

Page | 12 expertise to customize each task (including a further breakdown into subtasks) in order to improve the District’s ability to meet project goals in the most expeditious and cost-effective manner. Based on their experience, the Consultant may identify additional elements needed to meet the project goals.

The work, at a minimum, is anticipated to include the following tasks:

Task 1: Understanding of District’s OT Infrastructure

The purpose of this task is to collect and verify all information needed to develop the OT Incident Response & Disaster Recovery Plan. At a minimum, this task shall include data collection, review, and verification of OT equipment, configuration, and settings, through network scanning, staff interviews, and workshops.

The Consultant, with input from the District, shall develop a plan for site data collection which maximizes efficiency and minimizes impact to District operations.

Task 1 Deliverables:

· Draft and Final plans for site surveys and data collection/verification. At a minimum, plan shall identify schedule, data collected, coordination for minimizing impact to operations, and resource requirements.

· Copy of all data collected at each site

· Comprehensive inventory of all OT systems, applications, and processes

· Corrections to District provided information if found incorrect or incomplete

· OT infrastructure overview diagram

Task 2: Recovery Benchmarking

The purpose of this task is to perform a systematic process to define the maximum acceptable time a system or process can be down after a disruption before causing significant impact to the District.

The task shall include outlining the process to involve key stakeholders, identifying essential business functions and their dependencies, performing impact assessments, categorizing OT assets based on their criticality and impact, and validating and testing the defined objectives.

Task 2 Deliverables:

· Risk matrix

· Development of operations continuity metrics for Recovery Time Objective (RTO) and

Recovery Point Objective (RPO).

· A step-by-step process for District to evaluate that RTOs are achievable and to perform alternative analysis if recovery objectives cannot be met.

Task 3: Development of an Incident Response (IR) Plan

The goal of an IR Plan is to quickly identify, maintain forensic evidence, and contain and eradicate threats to minimize damage and loss of function to systems. It is expected that the IR plan should

Page | 13 focus on detecting, containing, and mitigating incidents which could affect the function or security of OT systems. Incidents to be addressed by the IR Plan could be due to a variety of events including physical, cybersecurity, and/or other events. It is desired that the IR Plan provides both high level of response guidance as well as specific actionable information. Key elements of the IR Plan include clearly defined roles and responsibilities, escalation procedures, communication protocols, and forensic analysis techniques.

Task 3 Deliverables:

· Draft and Final reports of Incident Response Plan which includes guidance for determining whether an incident has occurred or is taking place.

· Tabletop exercise(s) to run through the site(s) and event(s) addressed by the IR Plan.

· Identify actionable recommendations in areas of weakness and vulnerability discovered through the process.

Task 4: Disaster Recovery Plan (DR) Development

The goal of a Disaster Recovery Plan is the restoration of all critical operations functions after a major incident or disruption, whether it's a natural disaster, a cyberattack, or a hardware failure.

The DR plan shall consider RTO and RPO developed in Task 2.

Task 4 Deliverables:

· Draft and Final reports addressing data backup and recovery procedures for all 6 facilities at a minimum.

· Identify actionable recommendations in areas of weakness and vulnerability discovered through the process.

· Tabletop exercise(s) to run through the site(s) and event(s) addressed by the DR Plan.

· Contingency plans and procedures for various scenarios to ensure operational system continuity

TASK 5: Develop Incident Response & Disaster Recovery Run Books

Develop a detailed step-by-step guide outlining how to efficiently restore and recover from OT related incidents, cyber events, system crashes, or network outages to ensure business continuity and minimize downtime. It is expected that the Runbooks will be developed after the Incident Response & Disaster Recovery Plans are approved.

Task 5 Deliverables:

· Draft and Final Run Books for each facility

· Conduct trainings for OT Staff

· Conduct validation for OT Staff

TASK 6: Project Management (including Project Schedule)

Page | 14

The purpose of this task is to provide a Project Manager (PM) who, at minimum, will be responsible for the following: a) project development and performance, including the preparation, submittal and updates of a Project Schedule; b) quality assurance and quality control (QA/QC) of project deliverables c) coordinate and manage Consultant’s work; d) prepare monthly project invoices, e) prepare project status and final reports, as necessary, and f) communicate and correspond as necessary with the District's Project Manager on all project-related issues.

The Consultant’s PM shall be accessible to the District’s Project Manager during normal District working hours. A project schedule shall be prepared showing each task, identifying milestones for physical assessment, critical meetings/workshops, deliverables and District reviews. The schedule, including schedule updates, shall be submitted electronically in both Microsoft Project (.mpp) and PDF file formats. Schedule updates shall be submitted monthly, and no later than the first Friday of the month.

2.5. PROEJCT MANAGER & ESCALATION MATRIX

Consultant shall assign a Project Manager to the District who is able to maintain open and timely communication with District staff at all times and who can be reached during normal business hours. The Project Manager will be solely responsible and accountable for the quality of work and must be reachable by telephone or email.

Provide an organization chart for the proposed Project team and any subconsultants. The organization chart shall clearly identify the project manager who will be the District’s main point of contact and personnel responsible for coordinating key tasks. The organization chart shall be used in the event the Project Manager is not available. If changes are made, a revised organization chart must be submitted to the District’s Contract Administrator with the most current contact information.

3. PROPOSAL CONTENT AND SUBMITTAL

3.1. PROPOSAL CONTENT

The intent of this RFP is to encourage responses that clearly communicate the Proposer’s understanding of the requirements of this RFP and the Agreement for Services and its implementation. Submission of a proposal indicates acceptance by a firm of the conditions contained in this RFP, unless otherwise indicated in the proposal.

The proposal should set forth a comprehensive description of the approach to providing the Services required in Section 2.4 “Scope of Services” and should clearly demonstrate an understanding of the District’s requirements with a detailed description of work tasks that shall include the proposed methodologies, rationale, procedures and techniques to be utilized. For each work task defined in the Scope of Work the Prosper shall include a list of deliverables anticipated in completing the task.

Page | 15

Provide a detailed work plan and preliminary schedule identifying the major tasks and activities to be performed, personnel to be assigned and the estimated completion date for each task/activity should also be addressed.

In order to facilitate the Proposer’s preparation of its proposal and the District’s review of the same; proposals shall be limited to fifty (50) pages, not including the Letter of Introduction, table of contents, single page resumes of personnel selected for the project, certifications, work plan, and other required forms. Proposals should provide the requested information in a concise, well-organized manner and should follow the format outlined below.

· Letter of Introduction

A signed Letter of Introduction, on company letterhead, introducing the firm and summarizing the firm’s qualifications. It should clearly state the firm’s understanding of the requirements under this RFP and highlight any unique qualifications.

· Table of Contents

Include a Table of Contents displaying the organization of the proposal being submitted.

· Understanding of the Requirements

Consultant’s understanding of the Scope of Services as demonstrated through clear and concise articulation of criteria required to resolve the major issues and to complete the project, based upon existing information; and, the Consultant’s proposed approach to accomplishing the work.

Short examples (5 pages or less) of customer redacted Incident Response, Disaster Recovery and Runbook in an effort to show the structure and detail proposed.

· Proposer’s Qualifications and Experience

The following information should be included in the proposal:

o Qualifications and Experience of Company

Describe the firm, its size and organization, the number and location of offices, and general operational structure, as well as its management and technical personnel. Identify services the firm has provided to other public entities. Describe those aspects of the firm that pertain to the ability to provide superior service for the scope of services described under this RFP.

Evidence of certification and licenses, if applicable, must be submitted.

o Qualifications and Experience of Personnel

The individuals assigned to perform services will be an important factor considered by the Evaluation Committee. Provide the names of individuals who would be directly engaged in the performance of the scope of services. Identify the personnel and outline the team’s capacity to successfully perform the desired services. There can be no change of personnel, Page | 16 once a contract has been awarded, without the prior approval of the District. For each of these individuals, please submit:

Ø The number of years of experience providing the desired services, which must be a minimum of five (5) years.

Ø A summary of their experience providing similar services for public agency clients, professional affiliations, licensures and certifications.

Ø Provide resumes for the proposed personnel. Resumes shall not count towards the 50 -page limit.

· Responses to the following are to be part of your proposal.

o Overview describing scope, standards and methods employed by the Consultant for the development of Incident Response Plan & Disaster Recovery Plan.

o What is the recommended approach to logs on Firewalls, Servers, & Switches/Routers?

o What are best practices for tabletop exercises & simulations of Disaster Recovery?

o How much detail should be in IR/DRP plans versus Run Books?

o Describe your experience with a ransomware event including interactions with insurance companies, CISA and authorities such as the FBI.

· Project Schedule

Provide a detailed project schedule which identifies and documents submittal milestones, allowing for District review times, and key meeting dates. Assume District review for submittal will be two weeks per submittal draft.

· Estimated Level of Effort

Work shall be performed on a time and expenses basis with a “not to exceed” amount.

The estimated level of effort shall be presented in tabular format and include a breakdown of the work into discrete and detailed sets of tasks (and subtasks, if applicable). For each task and subtask, the Consultant shall characterize the level of effort by detailing the following:

A. Person-hours, categorized by staff member and role; and B. Subcontractor person-hours C. Total hours per task

The estimated level of effort table should also include a sub-total for the whole Proposal.

It is understood that the level of effort provided for optional tasks will be “budget” estimates only, since the details for these tasks are not fully understood at this time.

· Cost Proposal o Proposers must submit cost proposals for the complete scope of work by task. The cost proposal shall consist of a breakdown of each work task to include an estimate of total person-

Page | 17 hours for each project team member and or subconsultant, and associated units cost as appropriate.

o Consultant shall submit a current schedule of labor rates and equipment charges with the cost estimate. Hourly base rates for personnel, equipment and subconsultants shall be all inclusive of overhead for staff overtime, per diems, mobilization of personnel and equipment, test equipment, laboratory testing, health and safety equipment, office services and equipment, mobile telephone and communication equipment and service, transportation costs, report preparation, permitting, meetings, administrative charges, subcontractors time and equipment, and other miscellaneous expenses, as they apply to the project.

o Identify any impending changes that are expected to occur during the expected duration of the project.

o The fully loaded rates should include all possible costs, direct and indirect costs, travel, and any other expenses. Proposer may also include additional recommended services, if desired, which should be clearly identified as optional services and should be included as separate line items in the cost proposal.

o The hourly rates will apply to all phases of the project and for any additional ad-hoc services outside of the existing scope of services.

· Exceptions to RFP Documents o Submittal of a proposal shall be deemed as acceptance of all the terms set forth in this RFP and the Services Agreement; unless the Proposer includes with its proposal, any and all exceptions or modifications. Such exceptions and modifications shall be set forth in the Exceptions to Solicitation Documents form located in Appendix A. The District will not consider any exceptions received after the proposal due date.

o All Required Forms

Submit all the required forms provided in this solicitation, as set forth in Appendix A “Forms,” and all required submittals set forth in this RFP.

· A sample of Run Books that has been completed for other customers that contain a Disaster Recover and Incident Response Plans.

3.2. PROPOSAL SUBMITTAL

· Submission of Proposals

In order for firms to be considered for award the following submittals are to be included with Proposer’s response. Proposals shall be submitted via the District’s E-Procurement System, Euna Procurement at https://acwd.bonfirehub.com. Proposals must be received by the Procurement and Contracts Division via the District’s E-Procurement System, Euna Procurement at https://acwd.bonfirehub.com before the date and time specified in Section 1.5.

Proposals received after this time will not be considered for award.

· The District will not accept hard Copies of proposals.

Page | 18

· Proposal shall include Table of Contents and Letter of Introduction

· Cost Proposal

· All required Forms, located in Appendix A.

· Acknowledgement of Addenda, if applicable

· Sample Run Books for Disaster Recovery and Incident Response Plans.

· Evidence of Insurance

4. APPENDICES A,B,C,D

Appendix A – Required Forms

Appendix B – Sample Agreement

Appendix C – Non-Disclosure Agreement for Prosper and Subconsultants

Appendix D – Site Locations & Infrastructure

APPENDIX A

PROCUREMENT & CONTRACTS DIVISION

FORMS

PROPOSER QUALIFICATION FORM

This Statement is to accompany the proposal submitted in response to Request for Proposals No. RFP 25/26-02 Incident Response & Disaster Recovery Plans.

I certify that the following information submitted is true and correct:

The company has been engaged in performing similar services to those under this Solicitation within the United States for a minimum of five (5) years.

1. NAME OF PROPOSER: ____________________________________________

2. BUSINESS ADDRESS: ____________________________________________

3. TELEPHONE NO.: ____________________________________________

4. EMAIL: ____________________________________________

5. OFFICIAL REP. & TITLE: ____________________________________________

6. SIGNATURE: ____________________________________________

7. DATE: ____________________________________________

EXCEPTIONS TO SOLICITATION DOCUMENTS

Submittal of a proposal shall be deemed acceptance of all the requirements and terms set forth in this RFP and the sample Agreement, respectively, unless the Proposer includes with its proposal, in writing, any exceptions or modifications requested by the Proposer to this RFP or the sample Agreement. Please select one of the two options below.

q I, ____________________________, an authorized representative of _______________________________, have read, understand and confirm my acceptance of all the requirements of the District’s RFP and the terms of its sample Agreement without any exceptions.

q I, ____________________________, an authorized representative of _______________________________, have read the requirements of the District’s RFP and the terms of its sample Agreement and hereby stipulate the following exceptions:

REFERENCES FORM

Please provide three (3) references for contracts of similar scope and size within the past five (5) years.

These customers may be contacted by the District. Responses will be considered by the District during the proposal evaluation process.

1. Name: _________________________________________________________________

Address: _______________________________________________________________

City, State, Zip: ______________________________________________________ _____

Telephone /Email: ________________________________________________________

Contact Person and Role: __________________________________________________

Brief Description: ________________________________________________________

2. Name: _________________________________________________________________

Address: _______________________________________________________________

City, State, Zip: ______________________________________________________ _____

Telephone /Email: ________________________________________________________

Contact Person and Role: __________________________________________________

Brief Description: ________________________________________________________

3. Name: _________________________________________________________________

Address: _______________________________________________________________

City, State, Zip: ______________________________________________________ _____

Telephone /Email: ________________________________________________________

Contact Person and Role: __________________________________________________

Brief Description: ________________________________________________________

APPENDIX B

PROCUREMENT & CONTRACTS DIVISION

SAMPLE AGREEMENT FOR SERVICES

AGREEMENT FOR PROFESSIONAL SERVICES

THIS AGREEMENT is made by and between the ALAMEDA COUNTY WATER DISTRICT (“DISTRICT”) located at 43885 South Grimmer Boulevard, Fremont, CA 94538 and XXXXX (“CONSULTANT”), located at ADDRESS, CITY, STATE ZIP CODE (“PARTIES”).

WHEREAS, the DISTRICT desires to obtain services (Services) and issued a Request for Proposals XX/XX-XX [TITLE], dated XXXXX, a copy of which is attached and incorporated as Attachment 1.

WHEREAS, the CONSULTANT is ready, willing and able to furnish such services and has submitted a proposal dated, XXXXXX, a copy of which is attached and incorporated as Attachment 2.

NOW, THEREFORE, THE PARTIES AGREE AS FOLLOWS:

1. RENDITION OF SERVICES

The CONSULTANT agrees to provide services to the DISTRICT in accordance with the terms and conditions of this Agreement. CONSULTANT represents that it will exercise the same degree of professional care, skill, efficiency, and judgment ordinarily used by consultants providing similar professional services. CONSULTANT at all times will comply with all federal, state, and local laws, regulations and policies applicable to the services performed pursuant to this Agreement.

2. SCOPE OF SERVICES

The scope of the CONTRACTOR’s services is set forth in Attachment 1, as supplemented by Attachment 2. However, to the extent that Attachment 2 is inconsistent with Attachment 1, Attachment 1 will govern over Attachment 2.

3. TERM OF AGREEMENT

This Agreement will commence upon a written notice to proceed and conclude upon completion of work followed by final invoice submittal.

It is further understood that the Agreement is subject to the DISTRICT's right to terminate in accordance with Section 17 of this Agreement.

4. OWNERSHIP OF WORK

All reports, designs, drawings, plans, specifications, and other materials prepared, or in the process of being prepared, by CONSULTANT, its employees, subcontractors, or agents under this Agreement (“Work Product”) shall be and are the property of the DISTRICT.

The DISTRICT shall be entitled to access and to copy the Work Product during the progress of the work. If requested by DISTRICT, CONSULTANT shall deliver one copy of the Work Product remaining in the hands of the CONSULTANT, or in the hands of any subcontractor, upon completion or termination of the work.

CONSULTANT assigns to DISTRICT all right, title, and interest in and to the Work Product, including ownership of copyright in the Work Product. The DISTRICT may utilize any material prepared or work performed by CONSULTANT pursuant to this Agreement, including computer software, in any manner which the DISTRICT deems proper without additional compensation to CONSULTANT. CONSULTANT shall have no responsibility or liability for any revisions, changes, or corrections to the Work Product made by the DISTRICT, nor for any use or reuse of the Work Product for any purpose other than the Work unless CONSULTANT accepts such responsibility in writing. The CONSULTANT shall not disclose Work related data or information without the prior written consent of the DISTRICT.

5. USE OF SUBCONTRACTORS

CONSULTANT shall not subcontract any Services to be performed under this Agreement without the prior written approval of the DISTRICT. CONSULTANT may subcontract with service firms engaged in drawing, reproduction, typing and printing without the prior written consent of the DISTRICT.

CONSULTANT shall be solely responsible for reimbursing any subcontractor and the DISTRICT shall have no obligation to them.

6. CHANGES

The DISTRICT may, at any time, by written order, make changes within the scope of work and services described in this Agreement. If such changes cause an increase or decrease in the budgeted cost of or the time required for performance of the agreed upon work, an equitable adjustment as mutually agreed shall be made in the limit on compensation as set forth in Section 9 or in the term of the Agreement as set forth in Section 3, or both. In the event that CONSULTANT encounters any unanticipated conditions or contingencies that may affect the scope of work or services and result in an adjustment in the amount of compensation specified herein, CONSULTANT shall so advise the DISTRICT immediately upon notice of such condition or contingency. The written notice shall explain the circumstances giving rise to the unforeseen condition or contingency and shall set forth the proposed adjustment in compensation. This notice shall be given to the DISTRICT prior to the time that CONSULTANT performs work or services related to the proposed adjustment in compensation.

The pertinent changes shall be expressed in a written supplement to this Agreement prior to implementation of such changes.

7. RESPONSIBILITY; INDEMNIFICATION

To the fullest extent permitted by law, CONSULTANT shall indemnify, keep and save harmless the DISTRICT, and its board members, officers, agents, and employees against any and all suits, claims, actions, damages, liabilities, costs, and expenses (collectively, “Liabilities”) for any personal injury (including death, bodily injury, emotional or mental distress, and loss of consortium),…