5C0EA80C-4139-45B5-A953-BB738C64AEB0.pdf

1 | P a g e

Solicitation Number: RFQ033604

Date Issued: September 2, 2026

DEPARTMENT OF TECHNOLOGY

PHASE 1

CYBERSECURITY EVALUATION AND ENHANCEMENT SERVICES

Phase 1 Questions Due: September 10, 2026 @ 1:00 PM

Phase 1 Signed NDA Due: September 22, 2026 @ 1:00 PM

Estimated Phase 2 Bonfire Advertisement Opens:

Estimated to be the week of October 5, 2026. Exact date to be determined and submitters of NDAs will receive further information.

Estimated Phase 2 Proposals due on Bonfire:

Three weeks from advertisement open date. Exact date to be determined.

Procurement Portal: https://columbusvendorservices.powerappsportals.com/ https://columbusvendorservices.powerappsportals.com/

City of Columbus, Department Technology

RFQ033604 CYBERSECURITY EVALUATION SERVICES

Phase 1 Specifications

3 | P a g e

1.0 SCOPE AND CLASSIFICATION

Classification: The City of Columbus, Department of Technology will be receiving proposals for Cybersecurity Evaluation Services. This Request for Proposal (RFP) falls under the Ohio Revised Code §§9.64(F):

(F) A record identifying cybersecurity-related software, hardware, goods, and services, that are being considered for procurement, have been procured, or are being used by a political subdivision, including the vendor name, product name, project name, or project description, is a security record under section 149.433 of the Revised Code.

As such it contains confidential infrastructure and cybersecurity records of the City of Columbus.

These records may include sensitive information regarding the City’s cybersecurity program, network architecture, security controls, infrastructure configuration, and related operational safeguards. This solicitation utilizes the controlled-disclosure procurement process authorized by Columbus City Council Ordinance 1700-2026 and Ohio Revised Code Section 9.64. Therefore, a two-phase approach will be used to ensure sensitive information is only released to potential bidders.

• Phase 1: An upcoming RFP announcement is published on the Vendor portal with information on how to submit a signed Non-Disclosure Agreement (NDA) and provide information to request access to the complete RFP package.

• Phase 2: Those who submitted a signed NDA as a bid response to this announcement and provide contact information will receive an invitation only email link to access the complete documents through Bonfire. All questions and answers for phase 2 will be handled through Bonfire. Proposals will be submitted via Bonfire.

Specific times and dates regarding the submittal deadlines are outlined on page 1 of this document. The complete bid package will only be provided to potential offerors that execute the Non-Disclosure Agreement attached to this solicitation. No modifications of the NDA will be accepted. Potential offers have until September 22, 2026 @ 1:00 PM to submit a signed NDA. No late submissions will be accepted. Once the deadline has passed and the City’s review process has been completed, those who have submitted a signed NDA will receive an email link to Bonfire at the time the portal comes available for the complete RFP documents. See project schedule on page 1 for access date of Bonfire. An account on Bonfire https://columbus.bonfirehub.com/login will be necessary to access the documents. Only invited offerors who have completed the NDA will be able to submit proposals for this project. All subsequent question and answer periods and proposals will be submitted through the Bonfire portal. Execution of the NDA and receipt of Phase 2 documents does not create any right to award, selection, reimbursement, or continued participation in the procurement.

By executing the NDA and downloading the proposal documents from Bonfire, the offeror acknowledges and agrees that:

• The materials contain sensitive cybersecurity and infrastructure information of the City of Columbus.

https://codes.ohio.gov/ohio-revised-code/section-149.433 https://columbus.bonfirehub.com/login

• The information will be used solely for the purpose of preparing and submitting a response to this solicitation.

• The information may not be disclosed, reproduced, distributed, or used for any purpose other than preparation of a proposal in response to this solicitation, except as permitted under the executed NDA.

• Access to the information may be limited only to employees, subcontractors, consultants, or agents of the offeror who have a legitimate need to know the information for purposes of preparing the proposal and who are bound by confidentiality obligations no less restrictive than those contained in the NDA.

1.1 Scope: The intent of this contract is to provide the Department of Technology with readily available resources, including the people, processes and practices to assess, test, articulate and strengthen cybersecurity controls applied to critical IT infrastructure and applications. The collaborative works will involve the configuration, implementation, and continuous support services for the next iteration of Cybersecurity within the Department of Technology.

1.2 How to Submit Signed NDA: An unexecuted copy of the NDA is attached to this RFQ. To respond to the bid, attach the signed NDA along with complete contact information for those who should receive access to the Bonfire link to download bid documents or submit proposals. Multiple contacts may be requested for one company. Be sure to include the following information with the signed NDA:

Company Name Company Address Contact Name Contact Email Address (This will be the email the Bonfire invitation will be sent to and used to login to Bonfire) Contact phone number

Submit the signed NDA and contact information as a bid attachment. Enter a bid amount of $1.

The $1 amount is a placeholder required by the Vendor Services system and will not be considered in any evaluation, pricing review, or award determination. No further bidding information should be attached to this solicitation. See https://vcdocuattachments.blob.core.windows.net/vcdocumentsprod/Vendor%20Portal%20Us er%20Guide.pdf pages 33 – 37 for step-by-step instructions on how to enter and submit a bid.

After the submission due date, a counter signed NDA will be returned via Docusign.

2.0 QUESTIONS AND CORRESPONDENCE

2.1 Specification Questions: Questions regarding phase one of this bid must be submitted as an email to dotprocurement@columbus.gov by September 10, 2026 @ 1:00 PM. Responses will be posted to the RFQ on Vendor Services no later than September 14, 2026 @ 1:00 PM. This question period is for phase one only. No questions regarding the specific proposal will be answered at this time. All questions regarding phase 2 of the bidding process will be answered on Bonfire during the second phase.

https://vcdocuattachments.blob.core.windows.net/vcdocumentsprod/Vendor%20Portal%20User%20Guide.pdf https://vcdocuattachments.blob.core.windows.net/vcdocumentsprod/Vendor%20Portal%20User%20Guide.pdf mailto:dotprocurement@columbus.gov

2.2 Additional Information: For procedures on how to submit a proposal, you must go to the City of Columbus Vendor Services web site at CITY OF COLUMBUS VENDOR SERVICES (columbusvendorservices.powerappsportals.com) and view this bid number.

Instructional video from Columbus Vendor Services is available at:

https://www.youtube.com/channel/UCTIkkGNM7GHIITzoqQVNJlA/videos?shelf_id=0&view=0& sort=dd

2.3 Correspondences: During the bidding and evaluation process, Bidders are strictly prohibited from communicating with any City employees or officers regarding this solicitation. Any communication from the vendor to the City should be limited to only the contacts(s) listed below. A violation of this section on the part of the Bidder will lead to disqualification.

All correspondences regarding this bid should be sent via email to dotprocurement@columbus.gov.

2.4 Requirements to do Business

Vendors must register on the Vendor Services portal before doing business with the City of Columbus and becoming Minority or Women Business Enterprise (MBE/WBE) certified. To get registered, please visit the following link:

https://new.columbus.gov/Business-Development/Bids-Solicitations/Vendor-Resources.

After vendor registration, you will receive an email inviting you to complete the required Contract Compliance (EBO) Questionnaire. Vendors must be contract compliant in order to do business with the City of Columbus. To get compliant, please visit the following link:

https://new.columbus.gov/Business-Development/Bids-Solicitations/Vendor-Resources.

To complete our online certification application, track the status of your application and receive a copy of your certification approval letter, visit: https://columbus.diversitycompliance.com/.

For more certification information or questions, contact us at:

DiversityCertifications@columbus.gov.

For additional inquiries, contact the Office of Diversity and Inclusion at: odi@columbus.gov.

https://columbusvendorservices.powerappsportals.com/ https://www.youtube.com/channel/UCTIkkGNM7GHIITzoqQVNJlA/videos?shelf_id=0&view=0&sort=dd https://www.youtube.com/channel/UCTIkkGNM7GHIITzoqQVNJlA/videos?shelf_id=0&view=0&sort=dd mailto:dotprocurement@columbus.gov https://new.columbus.gov/Business-Development/Bids-Solicitations/Vendor-Resources https://new.columbus.gov/Business-Development/Bids-Solicitations/Vendor-Resources https://columbus.diversitycompliance.com/ mailto:DiversityCertifications@columbus.gov mailto:odi@columbus.gov

Revised 2026

EQUAL OPPORTUNITY CLAUSE

The Contractor will not unlawfully discriminate against any employee or applicant for employment because of race, sex, sexual orientation, gender identity or expression, color, religion, ancestry, national origin, age, disability, familial status or military status. The Contractor will take affirmative action to ensure that applicants are employed, and that employees are treated during employment without regard to their race, sex, sexual orientation, gender identity or expression, color, religion, ancestry, national origin, age, disability, familial status or military status. Such action shall include, but not be limited to, the following: employment up-grading, demotion, or termination; rates of pay or other forms of compensation; and selection for training. The Contractor agrees to post in conspicuous places, available to employees and applicants for employment, notices summarizing the provisions of this Equal Opportunity Clause.

The Contractor will, in all solicitations or advertisements for employees placed by or on behalf of the Contractor, state that the Contractor is an equal opportunity employer.

It is the policy of the City of Columbus that program members as defined in section 3901.01 of the Columbus City Codes shall have the maximum practicable opportunity to participate in the performance of contracts awarded by the City.

The Contractor shall permit access to any relevant and pertinent reports and documents by the Office of Diversity and Inclusion Director for the sole purpose of verifying compliance with

Title 39 of the Columbus City Codes, and with the Office of Diversity and Inclusion regulations.

All such materials provided to the Office of Diversity and Inclusion Director by the Contractor shall be considered confidential.

The Contractor will not obstruct or hinder the Office of Diversity and Inclusion Director or his/her deputies, staff and assistants in the fulfillment of the duties and responsibilities imposed by Title 39 of the Columbus City Codes.

The Contractor and each subcontractor will include a summary of this Equal Opportunity

Clause in every subcontract. The Contractor will take such action with respect to any subcontractor as is necessary as a means of enforcing the provisions of the Equal Opportunity Clause.

The Contractor agrees to refrain from subcontracting any part of this Contract or contract modification thereto to a contractor not holding a valid certification number as provided for in

Title 39 of the Columbus City Codes.

Failure or refusal of a Contractor or subcontractor to comply with the provisions of Title

39 of the Columbus City Codes may result in cancellation of this contract.