17-Category, Certification Disciplines Worksheet - PNC2131193B1.xlsx
XLSX spreadsheet 20 KB Posted
- Solicitation number
- PNC2131193B1
- Issued by
- Broward County, Florida
About this file
This is a Category, Certification, and Disciplines Worksheet for Broward County's Information Technology (IT) Security and Compliance Consulting Services contract opportunity (PNC2131193B1). The worksheet serves as a vendor response document for the Enterprise Technology Services Division and other Broward County agencies seeking qualified consulting vendors on an as-needed, pre-qualified basis. Vendors must complete the worksheet by marking applicable responses for eight service categories, fifty-nine professional certifications, and eighty-seven service disciplines, with the option to provide supplementary comments for each section. Responses may be submitted as part of the initial bid submission or within three business days of the County's request, and all documents and information are considered relevant to the evaluation process.
The worksheet is organized into three primary sections: Categories (including PCI Services, HIPAA Services, IT Audit Services, Cyber Security Penetration Testing, Incident Response, Public Safety Network Audits, IT Project Management, and Managed Services); Certifications (ranging from CISSP and CISM to cloud-specific credentials such as AWS and Azure certifications, as well as healthcare compliance certifications); and Disciplines (covering enterprise security strategy, governance, risk assessments, PCI DSS compliance, HIPAA controls, penetration testing, incident response, public safety technology, project management, and managed detection and response services). Category 7 (Information Technology Project Management) is identified as a reserved opportunity for County Business Enterprise (CBE) firms, while all other categories have no specific CBE participation goals assigned.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 8-Location Certification - Invitation to Bid.docx | DOCX document | |
| 7-Litigation History.docx | DOCX document | |
| 10-OESBD - CBE Reserve.docx | DOCX document | |
| 2-Anti-Human Trafficking Affidavit.docx | DOCX document | |
| 16-Specifications and Requirements - PNC2131193B1.pdf | ||
| 15-Special Instructions to Vendors - PNC2131193B1.pdf | ||
| 12-General Conditions - Quotes and Bids.pdf | ||
| 14-Minimum Insurance Requirements.pdf | ||
| 5-Subcontractors-Subconsultants-Suppliers Requirement.docx | DOCX document | |
| 6-Security Requirements.docx | DOCX document | |
| 9-OESBD - Procurement Preferences SBE-CBE.docx | DOCX document | |
| 1-Domestic Partnership Act Certification.docx | DOCX document | |
| 4-Summary of Vendor Rights for Broward County Competitive Solicitations.docx | DOCX document | |
| 11-Vendor Questionnaire - Quotes and Bids.docx | DOCX document | |
| 3-Insurance Requirements - Quotes Bids.docx | DOCX document | |
| 13-Enterprise Technology Services Security Requirements Exhibit - High Risk.pdf |
Show all 16
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Vendor Response Worksheet
| Category, Certification, and Disciplines Worksheet |
| INSTRUCTIONS: Complete the Categories, Certification, and Disciplines Worksheet (mark an "X" for applicable answer) and use the comments column to provide any additional explanation that will assist the County in its evaluation. Vendors must submit with bid or within three business days of County's request. |
| Vendor Name: |
| CATEGORIES | ||||
| No. | Category | YES | ||
| (Prime) | YES | |||
| (Sub-contractor) | NO | |||
| (Cannot Provide) | Vendor Comments | |||
| 1 | Payment Card Industry (PCI) Services | |||
| 2 | Health Insurance Portability and Accountability Act (HIPAA) Services | |||
| 3 | Information Technology Audit Services | |||
| 4 | Cyber Security Penetration Testing Services | |||
| 5 | Cyber Security Incident Response (CIR) Services | |||
| 6 | Public Safety Network and Systems Audit Services | |||
| 7 | Information Technology Project Management | |||
| 8 | Cyber Security, Risk, Regulatory, Technology Managed Services | |||
| CERTIFICATIONS | ||||
| No. | Certifications | YES | ||
| (Prime) | YES | |||
| (Sub-contractor) | NO | |||
| (Cannot Provide) | Vendor Comments | |||
| 9 | Certified Information Systems Security Professional (CISSP) | |||
| 10 | Certified Information Security Manager (CISM) | |||
| 11 | Certified Information Systems Auditor (CISA) | |||
| 12 | Certified in Risk and Information Systems Control (CRISC) | |||
| 13 | ISO/IEC 27001 Lead Auditor or Lead Implementer (ISO/IEC 27001) | |||
| 14 | ITIL 4 Managing Professional (ITIL 4) | |||
| 15 | Qualified Security Assessor (QSA) | |||
| 16 | Approved Scanning Provider (ASV) | |||
| 17 | Certified Internal Security Assessor (ISA) | |||
| 18 | P2PE Assessor (P2PE) | |||
| 19 | CompTIA Security+ (Security+) | |||
| 20 | Certified in Healthcare Compliance (CHC) | |||
| 21 | Certified HIPAA Professional (CHP) | |||
| 22 | Certified HIPAA Administrator (CHA) | |||
| 23 | HealthCare Information Security and Privacy Practitioner (HCISPP) | |||
| 24 | Certified in Healthcare Privacy & Security (CHPS) | |||
| 25 | HITRUST CSF Practitioner (HITRUST) | |||
| 26 | Certified Information Privacy Professional – US (CIPP/US) | |||
| 27 | Certified Internal Auditor (CIA) | |||
| 28 | Certified in the Governance of Enterprise IT (CGEIT) | |||
| 29 | ISO/IEC 22301 Business Continuity Lead Auditor (ISO 22301) | |||
| 30 | Certified Ethical Hacker (CEH) | |||
| 31 | Offensive Security Certified Professional (OSCP) | |||
| 32 | Offensive Security Web Expert (OSWE) | |||
| 33 | Licensed Penetration Tester (LPT) | |||
| 34 | GIAC Certified Penetration Tester (GPEN) | |||
| 35 | GIAC Web Application Penetration Tester (GWAPT) | |||
| 36 | GIAC Exploit Researcher & Advanced Penetration Tester (GXPN) | |||
| 37 | Certified Red Team Operator (CRTO) | |||
| 38 | Certified Network Defender (CND) | |||
| 39 | GIAC Certified Incident Handler (GCIH) | |||
| 40 | Certified Computer Security Incident Handler (CSIH) | |||
| 41 | GIAC Forensic Analyst (GCFA) | |||
| 42 | GIAC Enterprise Defender (GCED) | |||
| 43 | EnCase Certified Examiner (EnCE) | |||
| 44 | Certified Forensic Computer Examiner (CFCE) | |||
| 45 | Computer Hacking Forensic Investigator (CHFI) | |||
| 46 | GIAC Security Essentials (GSEC) | |||
| 47 | CJIS Security Awareness Certification (CJIS) | |||
| 48 | GIAC Critical Infrastructure Protection (GCIP) | |||
| 49 | Association of Public-Safety Communications Officials Certification (APCO) | |||
| 50 | National Emergency Number Association Certification (NENA) | |||
| 51 | Project Management Professional (PMP) | |||
| 52 | PMI Agile Certified Practitioner (PMI-ACP) | |||
| 53 | SAFe Agilist (SAFe) | |||
| 54 | Certified Cloud Security Professional (CCSP) | |||
| 55 | Certificate of Cloud Security Knowledge (CCSK) | |||
| 56 | AWS Certified Security – Specialty (AWS SCS-C02) | |||
| 57 | Azure Security Engineer (AZ-500) | |||
| 58 | Microsoft Cybersecurity Architect Expert (SC-100) | |||
| 59 | Security Operations Analyst (SC-200) | |||
| 60 | Identity and Access Administrator (SC-300) | |||
| 61 | Information Protection Administrator (SC-400) | |||
| 62 | Azure Solutions Architect (AZ-305) | |||
| 63 | AWS Solutions Architect – Professional | |||
| 64 | AWS SysOps Administrator – Associate | |||
| 65 | AWS DevOps Engineer – Professional | |||
| 66 | AI Governance / Responsible AI Certifications | |||
| 67 | IAPP-AI Governance Professional (AIGP) | |||
| 68 | GIAC Cloud Penetration Tester (GCPN) | |||
| 69 | GIAC Enterprise Incident Response (GEIR) | |||
| 70 | GIAC Experienced Penetration Tester (GX-PT) | |||
| 71 | GIAC Experienced Forensics Examiner (GX-FE) | |||
| 72 | GIAC Experienced Forensics Analyst (GX-FA) | |||
| 73 | GIAC Cloud Penetration Tester (GCPN) | |||
| D.3 - Concrete Testing | DISCIPLINES | |||
| No. | Disciplines | YES | ||
| (Prime) | YES | |||
| (Sub-contractor) | NO | |||
| (Cannot Provide) | Vendor Comments | |||
| 74 | Enterprise security strategy development | |||
| 75 | Cybersecurity governance operating model | |||
| 76 | Security committee and charter development | |||
| 77 | Policy, standards, and procedures lifecycle management | |||
| 78 | Metrics, KPIs, and executive reporting | |||
| 79 | Alignment to NIST CSF 2.0, NIST SP 800-53, CIS Controls | |||
| 80 | Enterprise risk assessments | |||
| 81 | Regulatory gap assessments | |||
| 82 | Control mapping and traceability | |||
| 83 | Risk register creation and maintenance | |||
| 84 | Third-party/vendor risk management | |||
| 85 | Exception and waiver management | |||
| 86 | NIST AI 600-1 Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile | |||
| 87 | Florida Statute §282.3185 | |||
| 88 | ISO/IEC 27001 | |||
| 89 | SOC 2 | |||
| 90 | maturity assessments | |||
| 91 | gap analyses | |||
| 92 | PCI DSS scoping and segmentation | |||
| 93 | Cardholder data flow mapping | |||
| 94 | P2PE design and validation | |||
| 95 | Secure payment application review | |||
| 96 | Vulnerability management for PCI environments | |||
| 97 | Breach response specific to payment systems | |||
| 98 | Network diagrams | |||
| 99 | PCI gap assessments | |||
| 100 | ROC/SAQ documentation | |||
| 101 | Network diagrams | |||
| 102 | HIPAA risk assessments | |||
| 103 | Corrective action plans | |||
| 104 | Policies and training materials | |||
| 105 | Logical access controls | |||
| 106 | Change management | |||
| 107 | Backup and recovery controls | |||
| 108 | System development lifecycle controls | |||
| 109 | Logging and monitoring effectiveness | |||
| 110 | Network device configuration reviews | |||
| 111 | Server and endpoint security reviews | |||
| 112 | Cloud control audits | |||
| 113 | Secure coding practices | |||
| 114 | Physical security controls | |||
| 115 | External network penetration testing | |||
| 116 | Internal network penetration testing | |||
| 117 | Web application testing (OWASP Top 10) | |||
| 118 | Wireless security testing | |||
| 119 | Social engineering assessments | |||
| 120 | Red team and adversary simulation | |||
| 121 | Incident response plan development | |||
| 122 | Live incident containment and eradication | |||
| 123 | Root cause analysis | |||
| 124 | Malware analysis | |||
| 125 | Evidence collection and preservation | |||
| 126 | Chain of custody management | |||
| 127 | SIEM/SOAR tuning | |||
| 128 | Threat intelligence integration | |||
| 129 | Use case development | |||
| 130 | Playbook creation | |||
| 131 | Post-incident reporting | |||
| 132 | Public Safety Technology | |||
| 133 | CJIS security compliance | |||
| 134 | CAD/RMS security assessments | |||
| 135 | 911 / PSAP infrastructure reviews | |||
| 136 | Radio and dispatch network audits | |||
| 137 | High availability and resilience planning | |||
| 138 | Inter-agency data sharing security | |||
| 139 | Waterfall, Agile, and hybrid delivery | |||
| 140 | Budget and schedule management | |||
| 141 | Vendor and contract oversight | |||
| 142 | Risk and issue management | |||
| 143 | Quality assurance and testing coordination | |||
| 144 | IT Project Management Tools (e.g., Jira, MS Project, ServiceNow) | |||
| 145 | Change management and adoption | |||
| 146 | Managed Detection & Response (MDR) | |||
| 147 | Continuous control monitoring | |||
| 148 | Vulnerability management as a service | |||
| 149 | Incident response retainers | |||
| 150 | Cloud security posture management | |||
| 151 | Secure cloud landing zones | |||
| 152 | Identity and access architecture | |||
| 153 | Multi-cloud security governance | |||
| 154 | Logging and monitoring architecture | |||
| 155 | FedRAMP& StateRAMP-aligned controls (where applicable) | |||
| 156 | Data classification and labeling | |||
| 157 | Data loss prevention (DLP) | |||
| 158 | Encryption and key management | |||
| 159 | Records retention and e-discovery support | |||
| 160 | AI Governance, policy and standards development frameworks | |||
| 161 | Model security and data integrity |
&"Arial,Bold"Functionality Checklist Form
&P of &N
File details come from the government source that posted it. Updated .