16-Specifications and Requirements - PNC2131193B1.pdf

SpecificaƟons and Requirements

InformaƟon Technology (IT) Security and Compliance ConsulƟng Services

1. ObjecƟve Broward County’s Enterprise Technology Services (ETS) Division is seeking to idenƟfy qualified vendors to be included on a pre-qualified vendor list for InformaƟon Technology (IT) Security and Compliance ConsulƟng Services on an as-needed basis for approximately 60 County agencies. The purpose of this solicitaƟon is to establish a list of qualified vendors that can provide services in the following eight (8) IT Security and Compliance ConsulƟng Services categories:

Category 1: Payment Card Industry (PCI) Services Category 2: Health Insurance Portability and Accountability Act (HIPAA) Services Category 3: InformaƟon Technology Audit Services Category 4: Cyber Security PenetraƟon TesƟng Services Category 5: Cyber Security Incident Response (CIR) Services Category 6: Public Safety Network and Systems Audit Services Category 7: InformaƟon Technology Project Management Category 8: Cyber Security, Risk, Regulatory, Technology Managed Services

The County seeks experienced, reliable, and highly skilled firms that can demonstrate experƟse in delivering comprehensive security soluƟons in one or more of the categories. Preferred candidates will have a provable track record of providing robust IT security services that align with industry best pracƟces and regulatory requirements.

As a need for services is idenƟfied, pre-qualified vendors within the given category(ies) of the Qualified Vendor List (QVL) will be able to parƟcipate in periodic pricing request for quotes idenƟfied by the County.

Vendors included in the QVL for the given category(ies) shall be invited to submit a formal Bid with an itemized wriƩen quote for said services. These vendors may submit itemized wriƩen quotes for mulƟple categories. Services will be awarded to the overall lowest responsive and responsible bidder. Upon award, the County will issue a NoƟce to Proceed (NTP) for the commencement of services.

2. DescripƟon of Categories

2.1. Category 1: Payment Card Industry (PCI) Services

Services within this category include acƟviƟes related to PCI compliance. Examples of specific acƟviƟes may include but not be limited to PCI audiƟng, web applicaƟon assessment from Approved Scanning Providers (ASV), risk assessment, remediaƟon consulƟng, gap analysis, training, credit card data breach response, evaluaƟng Point-to-Point EncrypƟon (P2PE) systems and implementaƟons.

2.2. Category 2: Health Insurance Portability and Accountability Act (HIPAA) Services

Services within this category require a thorough understanding of HIPAA regulaƟons and include acƟviƟes related to HIPAA compliance. Examples of specific acƟviƟes may include but not be limited to HIPAA audiƟng, risk analysis and assessment, gap analysis, technical and policy assessments, vulnerability scanning, penetraƟon tesƟng, and remediaƟon consulƟng. Vendor must demonstrate thorough understanding of HIPAA Privacy Rule, Security Rule, Breach NoƟficaƟon Rule and Enforcement Rule and provide detailed informaƟon on how their services ensure compliance with these regulaƟons.

2.3. Category 3: InformaƟon Technology Audit Services

Services within this category include IT Audit and Review Services. Examples of specific acƟviƟes may include but not be limited to evaluaƟon of IT General and ApplicaƟon controls, IT Governance, Security Strategies and Systems, General Network Topologies, connecƟons to External ParƟes, Inbound and Outbound Remote Access, IT Security Policies and Procedures, Network Device Security (e.g., switches, routers, firewalls, wireless access points) – Firmware and Patching Standards, Endpoint Devices (Servers, workstaƟons) – Patching and AnƟvirus checks, Physical Security, SoŌware Code security (e.g., secure coding), Data/ConfiguraƟon Backup and Disaster Recovery, Network Management, Provider/Contractor Access Management, System AdministraƟon/Privileged Access Management, and Network DocumentaƟon CreaƟon and Maintenance, and IT Audit Frameworks such as NaƟonal InsƟtute of Standards and Technology Cyber Security Framework (NIST CSF 2.0), Control ObjecƟves for InformaƟon and Related Technologies (COBIT), and ISO/IEC 27001.

2.4. Category 4: Cyber Security PenetraƟon TesƟng Services

Services within this category include Security PenetraƟon TesƟng Services. Examples of specific acƟviƟes may include but not be limited to Internal Network PenetraƟon TesƟng, External Network PenetraƟon TesƟng, Web ApplicaƟon TesƟng, Wireless Network PenetraƟon TesƟng, and Social Engineering Test Cases.

2.5. Category 5: Cyber Security Incident Response (CIR) Services

Services within this category include Security Architecture Design, Security Incident Response, Policy Review, and Digital Forensics. Incident response and management must be a core business funcƟon of Provider. Providers must be capable of supporƟng County (where requested) to eradicate an aƩacker, secure County’s environment, help rebuild affected systems and perform root cause analysis of how the incident occurred (where possible).

2.6. Category 6: Public Safety Network and Systems Audit Services Safety Industry

Services within this category include Public Safety Network /Systems Audit and Review Services. Examples of specific acƟviƟes may include but not be limited to evaluaƟon of IT General and ApplicaƟon controls, IT Governance, Security Strategy and Systems, General Public Safety Network Topology, ConnecƟons to External ParƟes, Inbound and Outbound Remote Access, IT Security Policies and Procedures, External Network PenetraƟon TesƟng, Network Device Security (i.e. switches, routers, firewalls, wireless access points) – Firmware and Patching Standards, Endpoint Devices (Servers, workstaƟons) – Patching and AnƟvirus checks, Physical Security, Data/ConfiguraƟon Backup and Disaster Recovery, Network Management, Provider/Contractor Access Management, System AdministraƟon/Privileged Access Management, and Network DocumentaƟon CreaƟon and Maintenance.

Note: All services listed in Category 6 are relevant to Network and Systems Audit Services within the Public Safety Network/Public Safety CommunicaƟons Infrastructure.

2.7. Category 7: InformaƟon Technology Project Management

Services within this category include InformaƟon Technology Project Management Services. Examples of specific acƟviƟes may include but not be limited to, project planning and scheduling, budget management, risks and issue management, quality assurance and tesƟng, technology implementaƟon, project plans, agile and hybrid methodology management, compliance and governance, performance monitoring and reporƟng.

Note: All services listed in Category 7 is relevant to InformaƟon Technology Project Management.

2.8. Category 8: Cyber Security, Risk, Regulatory, Technology Managed Services

Services within this category include risk, regulatory, technology managed services. Examples of specific acƟviƟes may include but not be limited to, business managed services (i.e., finance/ERP), risk and regulatory managed services (i.e., cybersecurity, audit), technology managed services (i.e., AI governance, AI Cybersecurity and risk miƟgaƟons, cloud operaƟons), digital and enterprise services management.

Note: All Services listed in Category 8 are relevant to Cyber Security, Risk, Regulatory, Technology Managed Services.

3. Vendor QualificaƟons

This secƟon outlines the qualificaƟons and criteria that vendors must meet to be considered for inclusion in the QVL in this RFQ. The qualificaƟons and criteria idenƟfied for each category is designed to ensure that prospecƟve vendors have the necessary experience, experƟse and resources to deliver high-quality, compliance security soluƟons. Vendors are required to provide detailed informaƟon and supporƟng documentaƟon for each category to demonstrate their capabiliƟes as further detailed in the aƩached EvaluaƟon Criteria document. By addressing these areas, Vendors will help to ensure that they meet the standards and expectaƟons necessary to support our security and compliance objecƟves.

3.1. Category 1: Payment Card Industry (PCI) Services

3.1.1. Minimum qualificaƟon requirements include:

3.1.1.1. A minimum of six years’ experience in vulnerability scanning and/or penetraƟon tesƟng. A minimum of three (3) years of experience in at least two (2) of the following areas of experƟse (for a total of at least five (5) years’ experience overall across the following four (4) disciplines):

3.1.1.1.1. Network security,

3.1.1.1.2. ApplicaƟon security, and

3.1.1.1.3. Computer systems security IT security audiƟng and risk assessment.

3.1.1.2. Current industry-recognized security cerƟficaƟons such as CerƟfied InformaƟon

Systems Auditor (CISA), CerƟfied InformaƟon Security Manager (CISM), CerƟfied InformaƟon Systems Security Professional (CISSP), Qualified Security Assessor (QSA), Approved Scanning Provider (ASV), or CerƟfied Internal Security Assessor

(ISA).

3.1.1.3. Compliance with PCI DSS Requirements: services must adhere to the PCI DSS standards to ensure the security of payment card data. The key PCI DSS requirements include:

3.1.1.3.1. Secure Network Architecture: Firewalls, routers, and other network configuraƟons to protect cardholder data,

3.1.1.3.2. Access Control: LimiƟng access to cardholder data on a need-to-know basis,

3.1.1.3.3. EncrypƟon: EncrypƟng sensiƟve cardholder data during storage and transmission, and

3.1.1.3.4. Regular Monitoring and TesƟng: ConƟnuous monitoring and tesƟng of security systems to idenƟfy and address vulnerabiliƟes.

3.2. Category 2: Health Insurance Portability and Accountability Act (HIPAA) Services

3.2.1. Minimum QualificaƟon Requirements include:

3.2.1.1. A minimum of three (3) to five (5) year of experience with Health InformaƟon Trust Alliance Common Security Framework (HITRUST CSF) and familiarity with InternaƟonal OrganizaƟon for StandardizaƟon/ InternaƟonal Electrotechnical Commission (ISO/IEC) 27001.

3.2.1.2. A minimum of three (3) projects of similar scope or iniƟaƟves providing the following services:

3.2.1.2.1. Business and Technology Advisory Services; or

3.2.1.2.2. System IntegraƟon Services for Enterprise InformaƟon Technology system projects within the past ten (10) years.

3.2.1.3. Current industry-recognized cerƟficaƟons such as CerƟfied in Healthcare

Compliance (CHC), CerƟfied InformaƟon Systems Security Professional (CISSP), CerƟfied InformaƟon Systems Auditor (CISA), CerƟfied InformaƟon Security Manager (CISM), CerƟfied HIPAA Professional (CHP), CerƟfied HIPAA Professional (CHP), CerƟfied HIPAA Administrator (CHA), Health InformaƟon Trust Alliance (HITRUST) or InternaƟonal OrganizaƟon for StandardizaƟon/ InternaƟonal Electrotechnical Commission (ISO/IEC) 27001.

3.3. Category 3: InformaƟon Technology Audit Services

3.3.1. Minimum qualificaƟon requirements include:

3.3.1.1. A minimum of three (3) to five (5) years of experience in the following areas:

3.3.1.1.1. Performing IT audits in a variety of industries (e.g., finance, government, etc.) and experience in specific areas such as network security, applicaƟon security, or compliance audits.

3.3.1.1.2. Knowledge of complex IT infrastructures such as networks, servers, databases, cloud services, and enterprise applicaƟons.

3.3.1.1.3. Experience with compliance audits such as PCI DSS, HIPAA, and General Data ProtecƟon RegulaƟon (GDPR).

3.3.1.1.4. Familiarity with Industry Standards and Frameworks such as Control ObjecƟves for InformaƟon and Related Technologies (COBIT), InformaƟon Technology Infrastructure Library (ITIL), NIST SP 800-53, ISO/IEC 27001 and ISO/IEC 27002, and PCI DSS.

3.3.1.1.5. Knowledge and understanding of both tradiƟonal IT

infrastructures (servers, network) and modern cloud environments (AWS, MicrosoŌ Azure, Google Cloud).

3.3.1.1.6. Experience audiƟng disaster recovery and business conƟnuity plans to ensure they meet industry standards and best pracƟces.

3.3.1.1.7. Experience working with regulatory bodies or undergoing audits by external regulators (e.g., IRS, FDA, SEC).

3.3.1.1.8. Current industry-recognized cerƟficaƟons such as CerƟfied InformaƟon Systems Auditor (CISA), CerƟfied InformaƟon Security Manager (CISM), CerƟfied Internal Auditor (CIA), CerƟfied InformaƟon Privacy Professional (CIPP), CerƟfied in Risk and InformaƟon Systems Control (CRISC), ISO/IEC 27001 Lead Auditor, CompTIA Security+, CerƟfied Ethical Hacker (CEH), or ISO 9001.

3.4. Category 4: Cyber Security PenetraƟon TesƟng Services

3.4.1. Minimum qualificaƟon requirements include:

3.4.1.1. A minimum of three (3) to five (5) years of experience and proven track record in the conducƟng and providing the following services:

3.4.1.1.1. PenetraƟon tesƟng services.

3.4.1.1.2. TesƟng various systems, such as web applicaƟons, networks, mobile apps, and cloud environments.

3.4.1.1.3. Adherence to ethical hacking principles, ensuring that tests are performed with proper authorizaƟon and within agreed-upon boundaries to prevent unauthorized access or damage.

3.4.1.1.4. Ability to tailor the penetraƟon tesƟng approach based on the County’s IT infrastructure, whether it’s an on-premises network, cloud environment, or hybrid system.

3.4.1.2. Knowledge of and ability to test specific environments such as:

3.4.1.2.1. Web ApplicaƟons (including frameworks like WordPress, Java, etc.)

3.4.1.2.2. Cloud Infrastructure (AWS, Azure, Google Cloud)

3.4.1.2.3. Mobile ApplicaƟons (iOS, Android)

3.4.1.2.4. Industrial Control Systems (ICS)

3.4.1.3. Compliance with established standards and frameworks for penetraƟon tesƟng to ensure comprehensive assessments including but not limited to Open Web ApplicaƟon Security Project (OWASP), PenetraƟon TesƟng ExecuƟon Standard (PTES), NaƟonal InsƟtute of Standards and Technology (NIST), and OWASP Mobile Security TesƟng Guide (MSTG).

3.4.1.4. Current industry-recognized cerƟficaƟons such as Offensive Security CerƟfied Professional (OSCP), CerƟfied Ethical Hacker (CEH), Licensed PenetraƟon Tester (LPT), Global InformaƟon Assurance CerƟficaƟon (GIAC) CerƟficaƟons (e.g., GIAC CerƟfied PenetraƟon Tester (GPEN), GIAC Web ApplicaƟon PenetraƟon Tester (GWAPT), or GIAC Exploit Researcher and Advanced PenetraƟon Tester (GXPN)).

3.5. Category 5: Cyber Security Incident Response (CIR) Services

3.5.1. Vendors must provide documented evidence of:

3.5.1.1. Ability to manage sophisƟcated cyber incidents occurring at any Ɵme (subject to reasonable capacity constraints caused by simultaneous incidents requiring response).

3.5.1.2. Ability to manage mulƟple incidents (potenƟally across mulƟple County agencies) simultaneously.

3.5.1.3. Experience working with high profile and complex incidents.

3.5.2. Minimum qualificaƟon requirements include:

3.5.2.1. A minimum of five (5) years of experience in following aƩack vectors; malware analysis, network forensics, endpoint security, and other relevant technologies to effecƟvely invesƟgate and respond to incidents.

3.5.2.2. Vendor’s assigned project manager must be able to prove foundaƟonal knowledge of cyber security. This can be demonstrated through academic qualificaƟons, professional cerƟficaƟons, or professional memberships. The following currently saƟsfy the requirements for proof of foundaƟonal knowledge:

3.5.2.2.1. an NCSC-cerƟfied degree (undergraduate or postgraduate);

3.5.2.2.2. CerƟfied InformaƟon Systems Security Professional (CISSP), including full membership of (ISC);

3.5.2.2.3. CerƟfied InformaƟon Security Manager (CISM), including full membership of ISACA;

3.5.2.2.4. Full membership of the Chartered InsƟtute for InformaƟon

Security (CIISec) and

3.5.2.2.5. Five years’ experience as a Senior Consultant in Cyber Incident

Response.

3.5.2.3. Vendors must have access to and proficiency with a variety of tools to support incident detecƟon, containment, and remediaƟon, including;

3.5.2.3.1. Advanced Security Tools

3.5.2.3.2. Security InformaƟon and Event Management (SEIM) (e.g., Splunk,)

3.5.2.3.3. Endpoint DetecƟon and Response (EDR) (e.g., Crowdstrike, BeyondTrust),

3.5.2.3.4. Forensic Tools (e.g., EnCase),

3.5.2.3.5. Network Monitoring and Analysis Tools (e.g., XXXXX) and

3.5.2.3.6. Malware Analysis Tools (e.g., XXXXX), Threat Intelligence Feeds

3.5.2.4. Vendors must demonstrate significant experience in responding to real-world cyber incidents, such as data breaches, malware infecƟons, ransomware aƩacks, and insider threats such as:

3.5.2.4.1. Malware outbreaks (viruses, worms, ransomware).

3.5.2.4.2. Phishing and social engineering aƩacks.

3.5.2.4.3. Data breaches and data leaks.

3.5.2.4.4. IT-OT threats

3.5.2.4.5. AI cyber aƩacks

3.5.2.4.6. Insider threats and privilege misuse.

3.5.2.4.7. Advanced Persistent Threats (APT).

3.5.2.4.8. Denial-of-service (DoS) or Distributed Denial-of-Service (DDoS) aƩacks.

3.5.2.5. Compliance with recognized incident response frameworks and best pracƟces to ensure comprehensive, effecƟve responses. These include the following; NIST SP 800-61 (Computer Security Incident Handling Guide), SANS Incident Handler’s Handbook, ISO/IEC 27035, and Forum of Incident Response and Security Teams

(FIRST).

3.5.2.6. Current Industry-recognized cerƟficaƟons such as CerƟfied Incident Handler (GCIH) with SOC 2 cerƟficaƟon, CerƟfied InformaƟon Systems Security Professional (CISSP), CerƟfied Ethical Hacker (CEH), CerƟfied Computer Security Incident Handler (CSIH), or GIAC Security EssenƟals (GSEC).

3.6. Category 6: Public Safety Network and Systems Audit Services Safety Industry

3.6.1. Minimum qualificaƟon requirements include:

3.6.1.1. A minimum of three (3) to five (5) years of experience working with public safety communicaƟon systems including but not limited to land mobile radio (LMR) systems, public safety broadband networks, public safety computer-aided dispatch (CAD) systems, and Enhanced 911 (E911) or Next Gen (NG911) systems.

Knowledge and understanding of Public Safety technology including but not limited to mission-criƟcal communicaƟons systems, integrated public safety systems such as emergency dispatch consoles, video surveillance systems, access control systems, interoperability frameworks, and geospaƟal informaƟon systems (GIS), and wireless communicaƟon technologies.

3.6.1.2. Current Industry-recognized cerƟficaƟons such as CerƟfied InformaƟon Systems Auditor (CISA), CerƟfied InformaƟon Security Manager (CISM), or CerƟfied Network Defender (CND) and NaƟonal Emergency Number AssociaƟon (NENA).

Compliance with industry standards such as Federal CommunicaƟons Commission (FCC), NaƟonal InsƟtute of Standards and Technology (NIST), APCO Project 25 (P25), NaƟonal TelecommunicaƟons and InformaƟon AdministraƟon’s (NTIA) Office of Public Safety CommunicaƟons (OPSC), and NaƟonal Public Safety TelecommunicaƟons Council (NPSTC).

3.6.1.3. Vendor must employ industry-standard tools and methodologies to audit networks and systems including but not limited to:

3.6.1.3.1. Firewall audits (e.g., AlogoSec, Tufin),

3.6.1.3.2. Network analysis (e.g., SolarWinds, Nagios),

3.6.1.3.3. Security and vulnerability scanning (e.g., Nessus, Qualys, Rapid7),

3.6.1.3.4. PenetraƟon tesƟng (e.g., Metasploit or Burp Suite), and

3.6.1.3.5. Data encrypƟon and transmission security (e.g., AES, IPsec, SSL/TLS)

3.6.1.4. Vendor must be knowledgeable about government requirements and compliance issues surrounding public safety systems, parƟcularly in relaƟon to data privacy, security, and interoperability including but not limited to:

3.6.1.4.1. Federal, state, and local regulaƟons such as PresidenƟal Policy DirecƟve 21 and Federal InformaƟon Security ModernizaƟon Act

(FISMA),

3.6.1.4.2. Data Privacy and ProtecƟon, and E911 Compliance such as Criminal JusƟce InformaƟon Services (CJIS), Personally IdenƟfiable InformaƟon (PII), Protected Health InformaƟon (PHI), and Law Enforcement SensiƟve (LES) data.

3.6.1.4.3. NENA E911 and NG 911 standards including NENA i3 Standard for Next GeneraƟon 9-1-1

3.6.1.5. Vendor must have the capability to assess the performance, reliability, and scalability of public safety networks, ensuring that systems can handle high-demand condiƟons during emergencies. This involves evaluaƟng the following:

3.6.1.5.1. Network capacity

3.6.1.5.2. Redundancy and failover systems

3.6.1.5.3. Latency and bandwidth

3.6.1.5.4. Interoperability

3.6.1.6. Vendor must have a thorough understanding of cybersecurity principles and pracƟces to evaluate the security posture of public safety systems. This includes assessing:

3.6.1.6.1. Network security

3.6.1.6.2. Physical security (e.g. gates, etc.)

3.6.1.6.3. Access control

3.6.1.6.4. Incident response

3.6.1.6.5. Data protecƟon

3.6.1.7. Vendor must have experience working with public safety-specific soŌware and hardware which may include but not be limited to:

3.6.1.7.1. Public safety Computer-Aided Dispatch (CAD) systems,

3.6.1.7.2. Law and/or Fire Rescue Records Management Systems (RMS),

3.6.1.7.3. Video Surveillance,

3.6.1.7.4. Public safety Mobile Data Terminals (MDTs),

3.6.1.7.5. Public safety land mobile radio (LMR) and digital mobile radio

(DMR) systems,

3.6.1.7.6. Fire staƟon alerƟng systems,

3.6.1.7.7. Microwave systems,

3.6.1.7.8. Alphanumeric paging systems,

3.6.1.7.9. Cloud hosted systems,

3.6.1.7.10. Public safety broadband networks,

3.6.1.7.11. Enhance 911 (E911) or Next Gen (NG911) systems.

3.6.1.8. Vendor must be able to provide detailed and acƟonable reports that summarize the audit findings, including but not limited to the following:

3.6.1.8.1. VulnerabiliƟes and risks

3.6.1.8.2. Compliance gaps

3.6.1.8.3. RecommendaƟons for remediaƟon

3.6.1.8.4. PrioriƟzaƟon of findings

3.6.1.9. Vendor must have demonstrated experience working on government projects, parƟcularly in areas of public safety, telecommunicaƟons systems, public safety communicaƟons infrastructure, and network security, will be criƟcal for establishing trust and credibility.

3.6.1.10. Vendor must have a history of successfully providing audit services for public safety networks and systems. References from other government agencies or public safety organizaƟons can help validate the Provider's qualificaƟons and capability.

3.7. Category 7: InformaƟon Technology Project Management

3.7.1. Minimum qualificaƟon requirements include:

3.7.1.1. Minimum of five (5) years of IT and business experience, including managing teams and project management.

3.7.1.2. Minimum of two (2) years of experience working with Senior Managers.

3.7.1.3. CerƟficaƟon as a Project Management Professional (PMP).

3.7.1.4. Proficiency with IT Project Management tool (e.g., Jira, MS Project, ServiceNow).

3.7.1.5. Proficiency in Agile and Hybrid (Waterfall) Methodology Management.

3.8. Category 8: Cyber Security, Risk, Regulatory, Technology Managed Services

3.8.1. Minimum qualificaƟons requirements include:

3.8.1.1. Minimum 5-7 years of experience in IT consulƟng, managed services, or technology infrastructure management,

3.8.1.2. Proven track record of designing, implemenƟng, and managing Enterprise-level

IT soluƟons,

3.8.1.3. Prior experiences in service delivery management,

3.8.1.4. Industry-recognized cerƟficaƟons such as ITIL, PMP, CISSP, Cloud (Azure, AWS),

3.8.1.5. Proficiencies with Cisco, MicrosoŌ, VMWare, and

3.8.1.6. Proficiencies in Cyber Security, cloud compuƟng & network architecture, and IT operaƟons.

3.9. Federal, State and Local Law, Regulatory Requirements

Vendors submiƫng Bids for services must abide by the following applicable federal, state and local laws, regulaƟons, and standards:

Federal, State and Local Laws, RegulaƟons and Standards

Name Type

Federal Laws and RegulaƟons

Federal InformaƟon Security ModernizaƟon Act (FISMA):

Requires federal agencies and their contractors to implement and maintain informaƟon security programs.

Health Insurance Portability and Accountability Act (HIPAA):

Regulates the handling of health-related informaƟon and mandates security and privacy protecƟons for healthcare providers, insurers, and their contractors.

Gramm-Leach-Bliley Act (GLBA): Applies to financial insƟtuƟons and sets requirements for safeguarding customer data, including IT security pracƟces.

Federal Risk and AuthorizaƟon Management Program (FedRAMP):

Establishes standardized security requirements for cloud service providers used by federal agencies.

Payment Card Industry Data Security Standard (PCI DSS):

A set of security standards for organizaƟons that handle credit card transacƟons to ensure protecƟon of payment data.

Cybersecurity InformaƟon Sharing Act

(CISA):

Encourages the sharing of cybersecurity threat informaƟon between private companies and government agencies.

State Laws and RegulaƟons (Florida):

Florida InformaƟon ProtecƟon Act

(FIPA):

Requires businesses to protect personal data and report breaches within 30 days. It also mandates security measures for sensiƟve data and personally idenƟfiable informaƟon (PII).

Florida Public Records Law: While not directly related to IT security, it governs access to public records, including electronic records, requiring agencies to ensure their systems' security and compliance with public access rules.

Florida AdministraƟve Code (FAC) Chapter 60GG-1:

Addresses IT security in the state’s informaƟon systems, detailing the security measures that must be implemented by state agencies.

Fla. Stat. § 282.3815 (2023): Florida Statute 282.3185 - Local Government Cybersecurity

Florida's Data Breach NoƟficaƟon Law: Specifies the requirements for noƟfying individuals and the state’s aƩorney general in the event of a data breach.

Florida's Cybersecurity Act:

Enhances state-level cybersecurity pracƟces and promotes collaboraƟon between state enƟƟes, the private sector, and other stakeholders to address threats.

Local Laws and RegulaƟons (Florida):

Broward County IT Security Policies: Local government policies governing IT security pracƟces, including guidelines for data protecƟon, disaster recovery, and network security.

Local Government Cybersecurity RegulaƟons:

Various ciƟes and counƟes in Florida have enacted their own cybersecurity policies to protect government systems and data from cyber threats.

Florida Local Government IT Security Standards:

Specific to local government enƟƟes in Florida, these standards outline IT security requirements for managing sensiƟve data and protecƟng government infrastructure.

Standards and Frameworks:

NaƟonal InsƟtute of Standards and Technology (NIST) Cybersecurity Framework:

Widely adopted by federal, state, and local agencies for managing cybersecurity risks, including in Florida, through guidelines like NIST SP 800-53 and NIST SP 800-171.

InternaƟonal OrganizaƟon for StandardizaƟon (ISO/IEC) 27001:

A global standard for managing informaƟon security, which some Florida organizaƟons adopt for IT security compliance.

Center for Internet Security (CIS) Controls:

A set of cybersecurity best pracƟces that many Florida enƟƟes use to enhance their cybersecurity posture.

Federal Trade Commission (FTC) Safeguards Rule:

A regulaƟon for financial insƟtuƟons, requiring them to develop a comprehensive informaƟon security program to protect customer informaƟon.

4. Staffing Vendor will assign a team of qualified professionals to perform the IT Security and Compliance consulƟng services described in this SOW. The team shall consist of a Project Manager, IT Security Consultants, Compliance Consultants, Risk Management Specialists, and PenetraƟon Testers (if applicable). Vendor will ensure that the personnel assigned to the project possess the appropriate cerƟficaƟons and experience, including but not limited to CISSP, CISM, CISA, and CEH.

County reserves the right to reject any proposed personnel based on inadequate qualificaƟons, poor references, or knowledge of previous inadequate performance. In addiƟon, County may request changes in staff based on performance and quality and require a replacement of equal or stronger qualificaƟons.

If replacement staff is requested by County, Vendor will have one (1) week to idenƟfy a replacement staff member. Upon approval of County of the replacement staff member, the individual must be able to begin work within two (2) weeks.

Staffing commitments are conƟngent upon the scope of services assigned within each contract. All awarded solicitaƟons are subject to the review and approval of County before the commencement of work which will be established through a Work AuthorizaƟon NoƟce to Proceed (NTP).

Vendor shall also provide weekly status reports to track progress, and the Vendor’s personnel will undergo background checks as required by the County for security and regulatory compliance.

4.1. Staffing Changes and TransiƟon

If Vendor anƟcipates any staffing changes that may affect the delivery of IT security and compliance consulƟng services, Vendor must noƟfy the County within five (5) business days of change and work with County to facilitate a smooth transiƟon.

The transiƟon will include providing knowledge transfer, handover of project tasks, and any necessary documentaƟon to the replacement personnel to ensure minimal disrupƟon to the project.

5. ReporƟng Requirements Vendor will provide comprehensive and Ɵmely reports to the County throughout the project. Reports shall include weekly status updates, milestone reports upon compleƟon of each project phase, and a final comprehensive report at the conclusion of the consulƟng services project. All reports should include detailed findings, acƟon items, risks, recommendaƟons, and a roadmap for addressing any idenƟfied issues. The final report shall be delivered within two (2) weeks of the compleƟon of the project. Ad-hoc reports may also be requested as needed, including security incident reports or addiƟonal assessments.

Due to the fluctuaƟon in federal and state rules, regulaƟon, policies, and funding it is important to note that assignments under the contracts will vary, may arise quickly and, in many cases, require intensive involvement of vendor(s) over a relaƟvely short period of Ɵme. Other projects may involve work by the successful vendor(s) over several months. The work product/deliverables expected from the Provider(s) may vary from project to project depending on the nature of the assignment. In some cases, the successful vendor(s) may be asked for an independent wriƩen report or assessment, including findings and recommendaƟons. In other cases, the vendor(s) may be asked to supplement County staff in performing the work required and to develop joint recommendaƟons. In all cases, and at the onset of each project, the successful vendor(s) and County will develop a NoƟce to Proceed (NTP) as idenƟfied in SecƟon 1.

5.1. Ad-Hoc Reports

County may request ad-hoc reports throughout the project, depending on the evolving needs of the project or unforeseen issues. Vendor shall respond to such requests in a Ɵmely manner (no later than five

(5) business days aŌer the request is made by County) and provide necessary reports based on the request, which may include:

5.1.1. Security incident reports: If a security incident occurs during the project, vendor will provide a report documenƟng the event, analysis, response acƟons, and recommendaƟons for future prevenƟon.

5.1.2. AddiƟonal assessments: If the scope of work changes or if addiƟonal assessments (e.g., vulnerability assessments, penetraƟon tesƟng) are required, vendor will provide detailed reports documenƟng the findings.

6. Payment Schedule

The payment for services will be based on the following:

6.1.1. Hourly rates or fixed price: Provider and County shall mutually agree on whether services will be billed at an hourly rate, a fixed fee, or a combinaƟon of both. The esƟmated total cost is based on an esƟmated number of hours or a fixed fee for the enƟre project.

6.1.2. Invoicing and payment terms: Invoicing will be pursuant to the applicable purchasing document for each project.