24_019_LH Cybersecurity Risk Assessment_RFP.pdf

MACON-BIBB COUNTY, GEORGIA

Request for Proposals (RFP)

FOR

Cybersecurity Risk Assessment Services

RFP 24-019-LH

92015

91861

25778

MACON-BIBB COUNTY

ISSUE DATE: April 5, 2024

DUE DATE: May 9, 2024

MBE/WBE/DBE Participation: Minority, Women Owned, and other Disadvantaged Business Enterprises are encouraged to participate in the solicitation process. Additionally, respondents are encouraged to use M/W/DBE sub-consultants where possible. Small and other disadvantaged businesses requiring assistance with the competitive process can contact Cherise Stephens, Small Business Affairs at (478) 300-2297 or cstephens@maconbibb.us

I. GENERAL

A. Invitation

Notice is hereby given that Macon-Bibb County will receive responses to the Request for Proposal for Cyber Security Risk Assessment services (1original plus 3 copies and 1 Flash Drive) in the Procurement Department, 700 Poplar Street, Suite 308, Macon, Georgia 31201, until 12:00 o’clock NOON at the time legally prevailing in Macon, Georgia on Thursday, May 9, 2024, for Cybersecurity Risk Assessment Services for Macon- Bibb County.

NO LATE RESPONSES WILL BE CONSIDERED

The names of responding firms will be publicly read on Thursday, May 9, 2024, at 2:00 P.M. in the Macon- Bibb County Procurement Department Conference Room, located at 700 Poplar Street, Suite 308, Macon, Ga 31201.

The deadline for submitting questions will be April 19, 2024, at 3:00 p.m. (EST).

All questions to be submitted via email only to Lhardwick@maconbibb.us

B. Definitions

Wherever the term “Owner”, “County”, or “Macon-Bibb County” occur in this document, it shall mean Macon- Bibb County, a political subdivision of the State of Georgia acting through the Macon-Bibb County Board of Commissioners.

C. Solicitation Documents

Announcement of this Request for Professional Services may also be posted on the Macon-Bibb County website at www.maconbibb.us/purchasing and on the Georgia Procurement Registry website https://ssl.doas.state.ga.us/PRSapp/PR_index.jsp

D. Insurance Requirements

Insurance coverage shall be carried with an insurance company licensed to do business in the State of Georgia.

All coverage should be written with insurance company with a Best Rating of A or better. Insurance shall be obtained prior to commencement of work and shall remain in force throughout the period of the contract.

Macon-Bibb County shall be named as additional insured on the policy.

Workers’ Compensation: Statutory Errors and Omission: $1,000,000 General Liability: $1,000,000 Any other applicable insurance required by law to provide Cyber Security Risk Assessment services

E. Submittals

Responses must be sealed and identified on the outside of the package as and delivered to

“RFP #24-019-LH – Cybersecurity Risk Assessment Services” Macon-Bibb County Procurement Department

700 Poplar Street Suite 308

Macon, Georgia 31201 Telephone: (478) 803-0550 mailto:Lhardwick@maconbibb.us http://www.maconbibb.us/purchasing https://ssl.doas.state.ga.us/PRSapp/PR_index.jsp

Submissions may not be withdrawn for a period of one hundred and twenty (120) days after the deadline on date of closing. Macon- Bibb reserves the right to reject any and all submissions and to waive technicalities and formalities. Respondents shall carefully read the information contained herein and submit a complete response to all requirements and questions as directed. Submittals and any other information submitted by in response to the RFP shall become the property of Macon-Bibb County.

F. Responsiveness

To be considered “responsive” the submission must include completed copies of the following documents:

• Price Proposal Form

• Proposer Qualification Form

• List of Sub-Consultants

• Minority Participation Goal

• Financial & Legal Stability Statement

• Georgia Security and Immigration Compliance Act (E-Verify) Affidavit

G. Responsibility

To be considered “responsible” the submitting firm must meet the following minimum qualifications:

• Seven (3) years of experience providing the services included herein

• Licensed to do business in the State of Georgia

• Financially and legally responsible to perform the services included herein

H. Reservations

Macon-Bibb County will not provide compensation to Respondents for any expenses incurred by the Respondent(s) for submittal preparation or for any demonstrations that may be made, unless otherwise expressly stated or required by law.

Each submission should be prepared simply and economically, providing a straightforward, concise description of your firm’s ability to meet the requirements of this RFP. Emphasis should be on completeness, clarity of content, responsiveness to the requirements, and an understanding of the Owner’s needs.

Macon-Bibb County makes no guarantee that an award will be made as a result of this RFP and reserves the right to accept or reject any or all submittals, with or without cause, waive any formalities or minor technical inconsistencies, or delete any item/requirement from this RFP or contract when deemed to be in the Owner’s best interest.

Macon-Bibb County will consider only representations made within the submission in response to this RFP.

Owner will not be bound to act by any previous knowledge, communication, or submission by the firms other than this RFP.

Failure to comply with the requirements contained herein may result in the submission being deemed “non-responsive” or “non-responsible”. Nonresponsive submissions will not be reviewed for potential award.

II. MINIMUM REQUIREMENTS

To be considered as “responsive”, all Proposers must provide documentation for the minimum requirements listed below.

1. Provide all appropriate Licenses and Certifications required in the State of Georgia to provide the goods and/or perform the Services stated in this RFP.

2. Have a minimum of seven (3) years’ experience in cyber security risk assessment consulting and providing the services described in this RFP.

3. Financially and legally responsible to perform the services included herein.

III. SCOPE OF SERVICES

The purpose of this RFP is to select the best-qualified Proposer and award a County approved contract to perform all activities associated with the goods and services described herein.

Macon Bibb County is soliciting proposals from qualified vendors to conduct a comprehensive assessment of its Information Technology (IT) Department. The primary goal is to develop a long-term technology roadmap to address the increasing complexity and growing demands for IT services from management, staff, and citizens. This assessment will focus on evaluating the existing IT infrastructure, staffing, technology utilization, funding, and resource allocation to identify gaps, recommend improvements, and enhance efficiencies.

Manage and assume accountabilities for all aspects of Cybersecurity Risk Assessment services including:

1. Current IT Infrastructure and Staffing Review:

Evaluate the existing IT infrastructure, including hardware, software, networks, and security measures.

o Assessment of on premise, SD-WAN, and XaaS platforms o Assessment and recommendation for policies, standards, procedures, and guidelines o Assess adherence to applicable compliance, privacy requirements, and regulations o Assess vendor management o Assess integrations (i.e., API) o Administrative, technical, and physical risk mitigation, transfer, and acceptance recommendations o Vulnerability assessment o IoT risk assessment o Assess critical infrastructure and resilience of services o Control-based risk assessment o Asset-based risk assessment o Threat-based risk assessment o Risk analysis impact and probabilities

• Analyze the current staffing structure, roles, and responsibilities within the IT department.

• Identify any gaps or deficiencies in the current infrastructure and staffing.

2. Technology Utilization Assessment:

• Review the effectiveness of current technology applications and systems in meeting organizational needs.

• Compare and contrast the existing technology infrastructure with current industry standards and emerging technologies.

• Provide recommendations for optimizing the use of technology to improve efficiency and effectiveness.

• Review the effectiveness of current technology applications and systems in meeting organizational needs.

• Compare and contrast the existing technology infrastructure with current industry standards and emerging technologies.

• Provide recommendations for optimizing the use of technology to improve efficiency and effectiveness.

3. Funding and Resource Allocation Analysis:

• Assess the funding levels supporting IT functions and operations.

• Evaluate the allocation of resources to ensure efficiency and cost-effectiveness.

• Recommend strategies for reallocating resources to better support IT initiatives and projects.

4. Alternative Service Delivery Options:

• Identify and evaluate alternative service delivery models that can meet Macon Bibb County’s needs more efficiently and cost-effectively.

• Provide recommendations for implementing innovative techniques and technologies to enhance service delivery.

Vendor Requirements:

• Demonstrated experience and expertise in providing technology assessment services to medium-sized government entities.

• Knowledge of current industry standards, emerging technologies, and best practices in IT infrastructure and management.

• Ability to critically analyze and compare existing technology infrastructure with industry benchmarks.

• Strong communication and presentation skills to effectively convey findings, recommendations, and action steps.

• Provide comprehensive risk assessment/analysis reporting, including initial and multi-year treatment plan based on criticality.

IV. SUBMITTAL FORMAT AND REQUIREMENTS

The requested proposal documentation should be submitted on 8-1/2” x 11 soft bound sheets. Include one

(1) original and three (3) printed copies. In addition, submit one (1) flash drive of the entire proposal. Each proposal mut be submitted in separate envelopes when submitting bids:

• Technical Proposal

• Cost Proposal

Submissions must be must be organized in a manner to display the required information in easily accessible tabs labeled:

Firm’s History / Background

• Letter of Interest

• History of the Firm (including years in business)

• Contact information (including address(es), telephone/Fax numbers, email, etc.

• Structure of the firm (include principal(s), project team, if applicable)

Experience

• Resume(s)

• Reference list

• List of projects with similar scope and size

Price Proposal

• Provide prices on the forms included

V. SCORING (total possible number of points = 100)

Experience on Similar Projects 20 pts Understanding Requirements and Objectives 20 pts Approach and Methodology 20 pts Presentation Assessment 15 pts Cost Effectiveness 25 pts

Evaluation Criteria:

Proposals will be evaluated based on the following criteria:

• Relevant experience and qualifications of the vendor in conducting similar IT assessments.

• Understanding of Macon Bibb County’s requirements and objectives.

• Approach and methodology proposed for conducting the assessment.

• Presentation should be prepared and delivered as an executive level presentation with a sample assessment.

• Cost-effectiveness and value proposition of the proposed services.

Macon Bibb County is committed to leveraging the findings from this IT assessment to develop a strategic long-term technology roadmap. We aim to enhance our IT capabilities, improve service delivery, and ensure efficient resource allocation to support our growing organization. We look forward to receiving proposals from qualified vendors who can assist us in achieving our technology roadmap objectives.

VI. AWARD BASIS

Award will be recommended to the respondent with the highest number of points.

BID FORM COST PROPOSAL

Hours and Location of Work: The Cybersecurity Risk Assessment Consultant will be expected to devote roughly 25 hours per week. Services shall be performed at Macon-Bibb County Technology Department Cherry Street, Macon, Georgia, 31201.

Macon-Bibb anticipates awarding a fixed price contract. Cost for service must be itemized pricing for each assessment produced. Itemized cost detail must be provided by the following categories:

Labor- fully burdened hourly rates and total number of hours estimated for each level of professional and administrative staff to be used to perform the tasks outlined in this RFP. Cost should be estimated based on each component of the work/task to be performed.

Travel Costs- state the amount of travel cost and basis of estimate to include trip destination, state the purpose of the trip, length of trip, air fare mileage expense, per diem cost, lodging and car rental.

Other Direct Cost – This category may include such items as postage and mailing, printing and reproduction costs, etc. Provide a basis of estimate for these costs.

ACKNOWLEDGMENT OF ADDENDUM

The undersigned Proposer acknowledged receipt of the following addendum, if issued, to the RPS. If none received, write “None Received.”

Addendum No. Dated:

Addendum No. Dated:

Addendum No. Dated:

Addendum No. Dated:

Addendum No. Dated:

Firm Signature

Print Name Title Date