2AF0D3C6-CFAE-439B-9933-0E673BBD1685.pdf

City of Columbus Invitation for Bid

Addendum Transmittal

Addendum #2 for

RFQ033604

CYBERSECURITY EVALUATION SERVICES

SEPTEMBER 14, 2026

IF YOU HAVE ALREADY SUBMITTED YOUR BID YOU WILL

NEED TO WITHDRAW YOUR BID, REVISE YOUR BID AND

RE-SUBMIT YOUR BID.

Items Include:

Bid Opening Date Change: No

E-mail Questions and Answers: Yes Questions received for RFQ033604 via DoTProcurement@columbus.gov

Q1. I have a signed NDA ready for RFQ033604, but the RFQ does not show up on my Bonfire interface.

I see several other RFQs, just not this one.

A1. The submission for this phase of the NDA should be attached/submitted using the City of Columbus

Vendor Services portal. Once the RFQ end time has passed, offerors who have submitted a signed NDA will receive an email link to Bonfire for the complete bid package.

Q2. I have registered in your portal as a vendor and I have watched all of the training videos and still cannot figure out how to upload the NDA so that I can be put in the list of companies that might be considered for this work and subsequently invited in the Bonfire portal.

A2. Instructions for attaching/uploading the NDA can be found in section 1.2 of the RFQ0033604

Binder, and also found on pages 33-37 of the Vendor Services Guide.

Q3. The Equal Opportunity Clause states the Contractor will not subcontract any part of the contract to a contractor not holding a valid certification number under Title 39 of the Columbus City Codes.

If an offeror intends to use a subcontractor for part of the services, must that subcontractor hold a Title 39 certification number at the time the Phase 2 proposal is submitted, or is it sufficient that the subcontractor obtains certification before the contract is executed or before the subcontracted work begins?

A3. All subcontractors must be contract compliant before a contract can be executed.

https://vcdocuattachments.blob.core.windows.net/vcdocumentsprod/Vendor%20Portal%20User%20Guide.pdf

Addendum Transmittal

Q4. May the NDA be executed electronically (for example through Docusign or Adobe Sign), or must it be wet-signed and scanned? The RFQ notes the countersigned copy will be returned via Docusign.

A4. The NDA can be executed electronically.

Q5. Must the signatory be a corporate officer? Please confirm that the Company name may be entered as the legal entity with its trade name (for example "THF Partners, Inc. d/b/a 248 Security").

A5. Signatory can be anyone with legal authority to sign the NDA on behalf of the company. Typically, that includes corporate officers but may include other designees of the company given that authority. If the authority is so designated to another person within the company, proof of the same should also be provided.

Q6. If a respondent intends to team with a subcontractor, must the subcontractor also execute and submit its own NDA in Phase 1 to receive Bonfire access, or does the prime's NDA with the flow-down in Section 14 suffice?

A6. Anyone who is to receive an invitation to Bonfire must submit an NDA.

Q7. Is there a limit on the number of contacts a company may list for Bonfire access, and may contacts be added or changed after the September 22 deadline?

A7. There is no limit on the number of contacts listed for Bonfire but respondents should limit the confidential information access to those with an actual need and take proper precautions for the data received under the NDA . It is requested that no contacts will be added or altered after September 22nd.

Q8. Must a vendor be fully registered on Vendor Services and contract compliant (EBO Contract

Compliance Questionnaire completed) before submitting the Phase 1 NDA bid, or only before submitting a Phase 2 proposal or before award? What is the typical processing time for each?

A8. A vendor must be contract compliant before a contract may be awarded. Once the questionnaires are completed the processing should be completed within 2 to 3 business days.

Q9. Please confirm the $1 placeholder bid is the only pricing element in Phase 1 and that no additional forms or attachments beyond the executed NDA and contact information are required.

A9. The $1 placeholder bid is the only pricing element in Phase 1. No additional forms or attachments beyond the executed NDA and contact information [Company Name, Company Address, Contact Name, Contact Email Address (This will be the email the Bonfire invitation will be sent to and used to login to Bonfire), Contact phone number] are required.

Addendum Transmittal

Q10. Will the Phase 2 documents on Bonfire describe the environment in scope (size, existing tooling, and whether operational technology, SCADA, or other critical infrastructure beyond enterprise IT is included), or should respondents expect to obtain those details through the Phase 2 question period?

A10. Phase 2 documents will provide that information. Additional information can be requested during the question period of Phase 2.

Q11. Will Phase 2 include a pre-proposal conference, and how long will the Phase 2 question period remain open?

A11. This question period is for Phase 1 only. Per the Phase 1 Bid Specifications, no questions regarding the specific proposal will be answered at this time. All questions regarding Phase 2 of the bidding process must be submitted on Bonfire during the second phase.

Q12. What is the anticipated contract term, and is there an estimated award date?

A12. This question period is for Phase 1 only. Per the Phase 1 Bid Specifications, no questions regarding

Q13. Is this a new initiative, or does it replace an existing contract or incumbent provider?

A13. This question period is for Phase 1 only. Per the Phase 1 Bid Specifications, no questions regarding

Q14. Please confirm that no NDA received after September 22, 2026 at 1:00 PM will be accepted and that there is no later path to Phase 2 access.

A14. All NDAs must be received by 9/22/26. No late submissions will be accepted.

Q15. Approximately how many endpoints are currently in scope, including workstations, laptops, servers, virtual machines, and mobile devices?

A15. This question period is for Phase 1 only. Per the Phase 1 Bid Specifications, no questions regarding

Q16. How many physical and virtual servers are in scope, and where are they hosted?

A16. This question period is for Phase 1 only. Per the Phase 1 Bid Specifications, no questions regarding

Addendum Transmittal

Q17. Please provide the approximate number of network devices in scope, including firewalls, routers, switches, wireless infrastructure, VPN gateways, and other security appliances.

A17. This question period is for Phase 1 only. Per the Phase 1 Bid Specifications, no questions regarding

Q18. Which public, private, or hybrid cloud environments are currently utilized, and approximately how many accounts, subscriptions, projects, and workloads are in scope?

A18. This question period is for Phase 1 only. Per the Phase 1 Bid Specifications, no questions regarding

Q19. What cybersecurity technologies and services are currently deployed for endpoint, network, identity, email, cloud, vulnerability, data, and threat protection?

A19. This question period is for Phase 1 only. Per the Phase 1 Bid Specifications, no questions regarding

Q20. Does the City currently operate a centralized SIEM or security analytics platform? If so, approximately how much security telemetry is ingested per day?

A20. This question period is for Phase 1 only. Per the Phase 1 Bid Specifications, no questions regarding

Q21. Which regulatory, statutory, contractual, and cybersecurity frameworks must the proposed solution support or demonstrate compliance with?

A21. This question period is for Phase 1 only. Per the Phase 1 Bid Specifications, no questions regarding

Q22. Will the City provide recent penetration tests, vulnerability assessments, risk assessments, audit findings, incident reports, architecture diagrams, and existing remediation plans to the selected provider?

A22. This question period is for Phase 1 only. Per the Phase 1 Bid Specifications, no questions regarding

Q23. Which existing ITSM, SIEM, SOAR, identity, endpoint, network, cloud, ticketing, asset-management, and collaboration platforms must the proposed capabilities integrate with?

A23. This question period is for Phase 1 only. Per the Phase 1 Bid Specifications, no questions regarding

Q24. MBE/WBE - Will you accept TSMSDC and WBENC certifications for this opp?

A24. Please see the City’s Office of Diversity and Inclusion webpage for information on all recognized certifications. https://www.columbus.gov/Government/Mayors-Office/Office-of-Diversity-and- Inclusion

Q25. May a prime contractor utilize subcontractors or teaming partners to perform portions of the

Phase 2 scope? If so, must each proposed subcontractor separately execute an NDA before being permitted to review the confidential Phase 2 solicitation documents?

A25. Yes, subcontracts are accepted but respondents will be held responsible for the breaches of the

NDA by their subs. How the respondents intend to bind their subs is up to them.

Q26. If multiple individuals from the same company require access to the Phase 2 Bonfire documents, is listing each individual's contact information with the company's Phase 1 NDA sufficient, or is a separate NDA required for each individual?

A26. One NDA to apply company-wide is sufficient.

Q27. Is there any qualification or eligibility screening during Phase 1 beyond timely submission of the unmodified executed NDA and required contact information?

A27. No, all qualifications will be collected during Phase 2.

Q28. Must a vendor be fully Contract Compliant/EBO-approved prior to submitting the Phase 1 NDA, or is Contract Compliance required later in the procurement process?

A28. A vendor must be contract compliant before a contract may be awarded.

Q29. For an out-of-state prime contractor and any proposed out-of-state subcontractors, are there any specific registration or certification requirements that must be completed prior to submitting a Phase 2 proposal?

A29. All requirements will be outlined in Phase 2.

Q30. Will all responsive vendors that submit the required NDA and contact information by the

September 22 deadline receive an invitation to Phase 2, or will there be an additional prequalification process?

A30. All vendors who submit a signed NDA will receive access.

https://www.columbus.gov/Government/Mayors-Office/Office-of-Diversity-and-Inclusion https://www.columbus.gov/Government/Mayors-Office/Office-of-Diversity-and-Inclusion

Q31. Without requesting any confidential Phase 2 scope information, are there any mandatory onsite requirements, local staffing requirements, or minimum response-time requirements that potential offerors should be aware of when determining whether to proceed to Phase 2?

A31. There is no information that can be provided at this time.

Q32. I'm trying to submit the NDA to see the RFP for RFQ033604; however, I receive an error indicating, I'm not authorized to bid (screenshot below). Can you please provide some assistance for how to address the error?

A32. Please contact vendorservices@columbus.gov, and they can assist you with Vendor Portal technical difficulties.

Q33. Is the NDA supposed to be submitted on the portal or through an email attachment?

A33. Per the Cybersecurity Evaluation Services Phase 1 Specifications, submit the signed NDA and contact information as a bid attachment through the Vendor Portal. See https://vcdocuattachments.blob.core.windows.net/vcdocumentsprod/Vendor%20Portal%20Use r%20Guide.pdf pages 33 – 37 for step-by-step instructions on how to enter and submit a bid.

Q34. How the government would prefer the additional personnel who would receive access to the

Bonfire link to download bid documents or submit proposals: Should we add their names and contact details in the NDA (below the existing space provided for the signatory), or should we include their names and contact details in an email when submitting the NDA?

A34. One NDA to apply company-wide is sufficient. A list of personnel names and contact details should be submitted along with the signed NDA.

mailto:vendorservices@columbus.gov