17-Category, Certification Disciplines Worksheet - PNC2131193B1.xlsx

XLSX spreadsheet 20 KB Posted

Attached to
Information Technology (IT) Security and Compliance Consulting Services
Solicitation number
PNC2131193B1
Issued by
Broward County, Florida

About this file

This is a Category, Certification, and Disciplines Worksheet for Broward County's Information Technology (IT) Security and Compliance Consulting Services contract opportunity (PNC2131193B1). The worksheet serves as a vendor response document for the Enterprise Technology Services Division and other Broward County agencies seeking qualified consulting vendors on an as-needed, pre-qualified basis. Vendors must complete the worksheet by marking applicable responses for eight service categories, fifty-nine professional certifications, and eighty-seven service disciplines, with the option to provide supplementary comments for each section. Responses may be submitted as part of the initial bid submission or within three business days of the County's request, and all documents and information are considered relevant to the evaluation process.

The worksheet is organized into three primary sections: Categories (including PCI Services, HIPAA Services, IT Audit Services, Cyber Security Penetration Testing, Incident Response, Public Safety Network Audits, IT Project Management, and Managed Services); Certifications (ranging from CISSP and CISM to cloud-specific credentials such as AWS and Azure certifications, as well as healthcare compliance certifications); and Disciplines (covering enterprise security strategy, governance, risk assessments, PCI DSS compliance, HIPAA controls, penetration testing, incident response, public safety technology, project management, and managed detection and response services). Category 7 (Information Technology Project Management) is identified as a reserved opportunity for County Business Enterprise (CBE) firms, while all other categories have no specific CBE participation goals assigned.

View the file

Other files

Show all 16

On GovTribe

Work with this file

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file

Text version

Vendor Response Worksheet

Category, Certification, and Disciplines Worksheet
INSTRUCTIONS: Complete the Categories, Certification, and Disciplines Worksheet (mark an "X" for applicable answer) and use the comments column to provide any additional explanation that will assist the County in its evaluation. Vendors must submit with bid or within three business days of County's request.
Vendor Name:
CATEGORIES
No.CategoryYES
(Prime)YES
(Sub-contractor)NO
(Cannot Provide)Vendor Comments
1Payment Card Industry (PCI) Services
2Health Insurance Portability and Accountability Act (HIPAA) Services
3Information Technology Audit Services
4Cyber Security Penetration Testing Services
5Cyber Security Incident Response (CIR) Services
6Public Safety Network and Systems Audit Services
7Information Technology Project Management
8Cyber Security, Risk, Regulatory, Technology Managed Services
CERTIFICATIONS
No.CertificationsYES
(Prime)YES
(Sub-contractor)NO
(Cannot Provide)Vendor Comments
9Certified Information Systems Security Professional (CISSP)
10Certified Information Security Manager (CISM)
11Certified Information Systems Auditor (CISA)
12Certified in Risk and Information Systems Control (CRISC)
13ISO/IEC 27001 Lead Auditor or Lead Implementer (ISO/IEC 27001)
14ITIL 4 Managing Professional (ITIL 4)
15Qualified Security Assessor (QSA)
16Approved Scanning Provider (ASV)
17Certified Internal Security Assessor (ISA)
18P2PE Assessor (P2PE)
19CompTIA Security+ (Security+)
20Certified in Healthcare Compliance (CHC)
21Certified HIPAA Professional (CHP)
22Certified HIPAA Administrator (CHA)
23HealthCare Information Security and Privacy Practitioner (HCISPP)
24Certified in Healthcare Privacy & Security (CHPS)
25HITRUST CSF Practitioner (HITRUST)
26Certified Information Privacy Professional – US (CIPP/US)
27Certified Internal Auditor (CIA)
28Certified in the Governance of Enterprise IT (CGEIT)
29ISO/IEC 22301 Business Continuity Lead Auditor (ISO 22301)
30Certified Ethical Hacker (CEH)
31Offensive Security Certified Professional (OSCP)
32Offensive Security Web Expert (OSWE)
33Licensed Penetration Tester (LPT)
34GIAC Certified Penetration Tester (GPEN)
35GIAC Web Application Penetration Tester (GWAPT)
36GIAC Exploit Researcher & Advanced Penetration Tester (GXPN)
37Certified Red Team Operator (CRTO)
38Certified Network Defender (CND)
39GIAC Certified Incident Handler (GCIH)
40Certified Computer Security Incident Handler (CSIH)
41GIAC Forensic Analyst (GCFA)
42GIAC Enterprise Defender (GCED)
43EnCase Certified Examiner (EnCE)
44Certified Forensic Computer Examiner (CFCE)
45Computer Hacking Forensic Investigator (CHFI)
46GIAC Security Essentials (GSEC)
47CJIS Security Awareness Certification (CJIS)
48GIAC Critical Infrastructure Protection (GCIP)
49Association of Public-Safety Communications Officials Certification (APCO)
50National Emergency Number Association Certification (NENA)
51Project Management Professional (PMP)
52PMI Agile Certified Practitioner (PMI-ACP)
53SAFe Agilist (SAFe)
54Certified Cloud Security Professional (CCSP)
55Certificate of Cloud Security Knowledge (CCSK)
56AWS Certified Security – Specialty (AWS SCS-C02)
57Azure Security Engineer (AZ-500)
58Microsoft Cybersecurity Architect Expert (SC-100)
59Security Operations Analyst (SC-200)
60Identity and Access Administrator (SC-300)
61Information Protection Administrator (SC-400)
62Azure Solutions Architect (AZ-305)
63AWS Solutions Architect – Professional
64AWS SysOps Administrator – Associate
65AWS DevOps Engineer – Professional
66AI Governance / Responsible AI Certifications
67IAPP-AI Governance Professional (AIGP)
68GIAC Cloud Penetration Tester (GCPN)
69GIAC Enterprise Incident Response (GEIR)
70GIAC Experienced Penetration Tester (GX-PT)
71GIAC Experienced Forensics Examiner (GX-FE)
72GIAC Experienced Forensics Analyst (GX-FA)
73GIAC Cloud Penetration Tester (GCPN)
D.3 - Concrete TestingDISCIPLINES
No.DisciplinesYES
(Prime)YES
(Sub-contractor)NO
(Cannot Provide)Vendor Comments
74Enterprise security strategy development
75Cybersecurity governance operating model
76Security committee and charter development
77Policy, standards, and procedures lifecycle management
78Metrics, KPIs, and executive reporting
79Alignment to NIST CSF 2.0, NIST SP 800-53, CIS Controls
80Enterprise risk assessments
81Regulatory gap assessments
82Control mapping and traceability
83Risk register creation and maintenance
84Third-party/vendor risk management
85Exception and waiver management
86NIST AI 600-1 Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile
87Florida Statute §282.3185
88ISO/IEC 27001
89SOC 2
90maturity assessments
91gap analyses
92PCI DSS scoping and segmentation
93Cardholder data flow mapping
94P2PE design and validation
95Secure payment application review
96Vulnerability management for PCI environments
97Breach response specific to payment systems
98Network diagrams
99PCI gap assessments
100ROC/SAQ documentation
101Network diagrams
102HIPAA risk assessments
103Corrective action plans
104Policies and training materials
105Logical access controls
106Change management
107Backup and recovery controls
108System development lifecycle controls
109Logging and monitoring effectiveness
110Network device configuration reviews
111Server and endpoint security reviews
112Cloud control audits
113Secure coding practices
114Physical security controls
115External network penetration testing
116Internal network penetration testing
117Web application testing (OWASP Top 10)
118Wireless security testing
119Social engineering assessments
120Red team and adversary simulation
121Incident response plan development
122Live incident containment and eradication
123Root cause analysis
124Malware analysis
125Evidence collection and preservation
126Chain of custody management
127SIEM/SOAR tuning
128Threat intelligence integration
129Use case development
130Playbook creation
131Post-incident reporting
132Public Safety Technology
133CJIS security compliance
134CAD/RMS security assessments
135911 / PSAP infrastructure reviews
136Radio and dispatch network audits
137High availability and resilience planning
138Inter-agency data sharing security
139Waterfall, Agile, and hybrid delivery
140Budget and schedule management
141Vendor and contract oversight
142Risk and issue management
143Quality assurance and testing coordination
144IT Project Management Tools (e.g., Jira, MS Project, ServiceNow)
145Change management and adoption
146Managed Detection & Response (MDR)
147Continuous control monitoring
148Vulnerability management as a service
149Incident response retainers
150Cloud security posture management
151Secure cloud landing zones
152Identity and access architecture
153Multi-cloud security governance
154Logging and monitoring architecture
155FedRAMP& StateRAMP-aligned controls (where applicable)
156Data classification and labeling
157Data loss prevention (DLP)
158Encryption and key management
159Records retention and e-discovery support
160AI Governance, policy and standards development frameworks
161Model security and data integrity

&"Arial,Bold"Functionality Checklist Form

&P of &N

File details come from the government source that posted it. Updated .