5-RFP 26-32 - ITS for Security Consulting Services - Scope of Work.pdf

Montgomery County, PA Information & Technology Solutions

Request for Proposal (RFP): 26-32 Security Consulting Services

1. Introduction

Montgomery County is seeking qualified security consulting firms to provide on-call cybersecurity and information security consulting services. This engagement is explicitly aligned to the NIST Cybersecurity Framework (CSF) as the County’s primary cybersecurity framework. The purpose of this engagement is to strengthen the County’s security posture, reduce cyber risk, support regulatory and policy compliance, and protect County information systems, data, and critical services through a risk-based, standards-driven approach.

Services may include incident response, Managed Security as a Services (MSSP), strategic security planning, technical assessments and advisory services, risk management, Governance, Risk and Compliance services, cybersecurity and data protection training, and identity access management advisory and support services all tailored to the needs of a complex public sector environment and mapped to NIST CSF Functions (Identify, Protect, Detect, Respond, Recover) and applicable NIST 800 -53, 800-73, and 800-171 control families.

2. Background Montgomery County, the third most populous county in Pennsylvania, serves more than 860,000 residents across 62 municipalities. The County operates a diverse technology environment supporting public safety, health and human services, courts, elections, and administrative functions.

As cyber threats continue to increase frequency and sophistication, the County requires access to experienced security consultants who understand government operations, regulatory obligations, and best practices for cybersecurity across

RFP for Security Consulting Services enterprise and federated IT operations. This RFP establishes a pool of qualified firms capable of providing a range of cybersecurity consulting services on an as needed basis .

The County encourages proposals from firms owned and operated by Women, Minorities, and/or Veterans, firms based locally in Montgomery County, PA, and firms of varying sizes. No additional evaluation weight will be given based on these factors.

3. Purpose & Objectives The purpose of this RFP is to establish agreements with security consulting firms that can:

• Identify and assess cybersecurity risks across County systems and operations using the NIST CSF risk based model .

• Map current and target state security capabilities to NIST 800 -53, 800-73 and

800-171 controls and to applicable policy and procedures needed to enforce and govern the application of these controls.

• Provide actionable, prioritized recommendations to improve security controls, adopt zero trust practices, resilience of systems/programs/personnel, and governance.

• Conduct work on behalf of the county to configure, monitor, and maintain systems and capabilities to ensure the highest levels of cyber and data security operations including but not limited to threat detection, identity access management, endpoint security, data loss prevention controls, Cloud and on-prem system security protocols, security information and event management (SIEM), etc.,

• Support compliance with applicable laws, regulations, and standards through a NIST aligned control framework

• Assist County leadership in shifting to decision-making based on risk assessments and risk management using measurable indicators and decision-making rubrics.

• Assist the County in adopting an ever-evolving model for cybersecurity and data management.

4. Scope of Services Selected firms will provide security consulting services on an on-call, project order basis. Services may include, but are not limited to, the following:

A. Governance, Risk, and Compliance (GRC) o Enterprise and system-level cybersecurity risk assessments and remediation plans aligned to NIST CSF Identify (ID) functions .

o Security program and control maturity assessments and remediation using NIST CSF Profiles o Development and maintenance of risk registers mapped to NIST 800-53, 800-73, 800-171 controls , where applicable.

o Policy, standard, and procedure development or review and updates to support adoption and adherence to NIST controls and County governance objectives o Support for compliance initiatives and audits (e.g., CJIS, HIPAA, PCIDSS, IRS 1075) using NIST 800 -53, 800-73, 800-171 as the baseline control families.

o Third-party and vendor security risk assessments aligned to NIST CSF Supply Chain Risk Management (ID.SC)

B. Security Assessments and Testing o Network, application, and system security assessments mapped to NIST technical and operational controls o Vulnerability assessments with risk-based remediation guidance aligned to NIST CSF Protect (PR) and Detect (DE) functions o Penetration testing coordination, oversight, and results interpretation with findings mapped to NIST 800 53 controls o Secure configuration, architecture, and design reviews for on-premises, cloud, and hybrid environments including endpoint threat detection and response, identity access management, and network access controls.

C. Incident Response and Readiness o Incident response plan development and review aligned to NIST 800- 61 and NIST CSF Respond (RS) and Recover (RC) functions o Tabletop exercises and simulations based on realistic threat scenarios affecting public sector environment s o Breach response advisory support, including coordination with legal, communications, and executive stakeholders o Post incident analysis, root cause assessment, and remediation recommendations mapped to NIST CSF outcomes .

o Technical response to data breach, intrustions, ransomware, or other attacks requiring system cleaning, recovery and restoration efforts working with County personnel.

o Incident response on-site coordination and oversight of investigation, recovery, and communications efforts working with County personnel.

D. Identity, Access, and Data Protection o Identity and access management (IAM) strategy and technical assessments aligned to NIST 800-53, 800-73 Access Control (AC) and Identification and Authentication (IA) families .

o MFA, privileged access management, and role-based access control reviews .

o Data classification, data protection, encryption, and loss prevention strategies aligned to NIST 800 -53 and NIST CSF Protect (PR) categories .

E. Strategic Security Advisory Services o Development of NIST CSF Profiles, cybersecurity roadmaps, and multiyear security strategies including system or program level detailed plans.

o Gap analysis between current state and target state IT control implementations .

o Security architecture reviews and security tool rationalization aligned to NIST principles.

o Budgetary planning and cost benefit analyses tied to risk reduction and control maturity improvements .

o Executive, senior leadership, and board level security briefings using NIST aligned metrics and visuals .

F. Training and Awareness o Security awareness and training program development aligned to NIST CSF Protect (PR.AT) and available on-demand SaaS delivery, modular format of continuous learning (not a single annual training), with ever green content encompassing data governance, AI, HIPAA, and CJIS topics.

o Role based security training recommendations for technical, administrative, and executive staff o Phishing simulation and awareness campaign advisory support tied to measurable risk reduction outcomes

The County reserves the right to request additional related security services that align with its cybersecurity objectives and NIST based security framework.

5. Proposal Format Proposals must be submitted electronically in PDF format through the County’s Bonfire (Euna) Portal and must include page numbers. Technical proposals must be submitted separately from cost proposals.

Technical Proposal

A. General Approach o Firm’s approach to delivering security consulting and advisory services .

o Approach to guiding clients to fully adopt and measure security using

NIST 800-53, 800-73, 800-171 controls and applicable policies and procedures (at enterprise and system levels).

o Must not include cost information

B. Experience and Expertise o Relevant experience providing cybersecurity services to government or regulated entities including operational (e.g., MSSP, incident response, Entra ID optimization) tasks and advisory (e.g., gap analysis, controls mapping, system-level security improvement plans).

o Case studies or project summaries demonstrating measurable risk reduction or maturity improvement by clients.

o Qualifications, certifications, and experience of key personnel

C. References o A minimum of three references for security consulting engagements including advisory and technical projects.

Cost Proposal o Hourly rate schedule by role o Any volume or service package discounts o Submitted separately from technical proposal

6. Evaluation Criteria Proposals will be evaluated based on:

• Demonstrated cybersecurity and public-sector experience

• Quality, clarity, and practicality of the proposed services and methods and approach for engagement with the County (applicable to the service or services offered).

• Cost competitiveness and transparency

• References and past performance

All criteria will be weighted equally.

7. Contractual Information Contracts will be project order agreements under a master on call contract.

Individual projects will not exceed $300,000 with a total not to exceed amount of $1,000,000 per firm over the initial three-year term, with potential extensions up to a total term of five years .

Firms must agree to the County’s standard terms and conditions without modification.

8. Proposal Submission and Questions All proposals are to be submitted through the Bonfire (Euna) Portal. Proposals will be submitted/uploaded as described above.

All questions must be submitted through the Bonfire procurement portal, and answers will be posted online for public review