Attachment_A_RFP_TSD-20261929_Security_Awareness_Learning_and_User_Education_Platform.pdf

RFP# TSD-20261929 i

REQUEST FOR PROPOSALS

Title: Security Awareness Learning and User Education Platform

The County of San Mateo (County) is seeking proposals from well qualified proposers to provide security awareness training and education through a rich, multi-media platform, countywide.

Functionality should be robust and provide real world examples and testing of personnel for common security awareness subjects such as phishing business email compromise (BEC) and other areas.

Solicitation Number TSD-20261929

Number of contracts expected to be awarded 1

Estimated Value or Range per contract To be determined

Funding Sources ☐Federal ☐State ☒County ☐Other

Expected Contract Duration 36 - 60 months

Options to Renew To be determined

Proposal submission format 1 electronic copy, uploaded to OpenGov site

County Mailing Address (for hard-copy communication only)

County of San Mateo- Technology Services Department 455 County Center, 3rd Floor Redwood City, CA 94063

Authorized Contact Person Jason Li

Authorized Contact Person E-mail ISD_Solicitations@smcgov.org

E-mail Address for Protests ISD_Protest_Officer@smcgov.org

RFP Released April 17, 2026

Pre-proposal meeting date and time April 27, 2026, 1:00 p.m. PST

Pre-proposal meeting location Microsoft Teams meeting Meeting ID: 231 460 619 933 82 Passcode: Hx7hv6mm

Deadline for Questions, Comments and Exceptions April 30, 2026, 1:00 P.M. PST

Proposal Due Date and Time May 14, 2026, 1:00 P.M. PST

Interviews To be determined

Submission to County Board for approval To be determined

Anticipated Contract Award Date To be determined

Attachments:

Attachment B: Price Proposal Template- Required with submissions Attachment C: References Template- Required with submissions Attachment D: Technology Security Assessment- Required with submissions Attachment E: County Standard Contract Template- Review/Submit Attachment F: SMC Local Preference Self-Attestation Form – Review/Submit Important Reminder: All proposers must complete and submit the required attachments listed above with their proposals. No exceptions will be made to this requirement. Proposals that fail to comply are non-responsive and are ineligible for consideration.

RFP# TSD-20261929 ii

TABLE OF CONTENTS

SECTION I - DEFINITIONS

SECTION II - INSTRUCTIONS FOR PROPOSERS

2.1 PRE-SUBMITTAL ACTIVITIES

A. Registration B. Questions, Comments, Exceptions C. Revisions to the Solicitation D. Contact with County Employees E. Pre-proposal conference and site visits

2.2 PROPOSAL CONTENT REQUIREMENTS

A. Proposal Format B. Technical Proposal Contents C. Supplementary Documents D. Price Proposal

2.3 PROPOSAL SUBMISSION

A. Submit proposals as directed below B. Errors in Proposals

2.4 PROPOSER CERTIFICATIONS

2.5 PROCUREMENT PREFERENCE FOR LOCAL BUSINESS AND LOCAL NON-PROFITS

2.6 WITHDRAWAL OF PROPOSALS

2.7 NO COMMITMENT

2.8 ESTIMATED QUANTITIES

2.9 PROPOSER SELECTION

A. Determination of Responsiveness B. Proposal Evaluation C. Determination of Responsibility

2.10 CONTRACT AWARD

A. Notice of Intent to Award B. Award Procedure C. Commencement of Performance D. Levine Act Disclosure

2.11 PROTESTS

A. Protest Eligibility, Format, and Address B. Protest Deadlines C. Protest Contents D. Reply to Protest E. No Stay of Procurement Action during Protest

2.12 PUBLIC RECORDS

A. General

SECTION III - QUALIFICATIONS, EXPERIENCE, AND EVALUATION CRITERIA

3.1 MINIMUM QUALIFICATIONS

3.2 PROCUREMENT PREFERENCE FOR LOCAL BUSINESSES AND LOCAL NON-PROFITS

A. Is the Proposer a “Local Business”?

RFP# TSD-20261929 iii

B. Is the Proposer a Non-Profit?

C. Is the Proposer a Local “Small” or “Micro” Business?

D. Is the Proposer a Local “Small” or “Micro” Non-Profit?

3.3 ORGANIZATIONAL CAPACITY AND EXPERIENCE

A. Organizational Capacity:

B. Experience

3.4 REFERENCES

3.5 EVALUATION CRITERIA

SECTION IV - INSURANCE

4.1 SPECIAL INSURANCE REQUIREMENTS - CYBER LIABILITY

SECTION V - STANDARD TERMS AND CONDITIONS

SECTION VI - SCOPE OF WORK AND SPECIAL PROVISIONS

6.1 SUMMARY

6.2 PERFORMANCE MEASURE

6.3 REQUIREMENTS AND SCOPE OF WORK

6.4 FINGERPRINTING AND BACKGROUND CHECKS

RFP# TSD-20261929 4 Rev 12/15/2025

SECTION I - DEFINITIONS

Business Day: Monday through Friday except for holidays as observed per the California Government Code.

Confidential Information: Information in any form that is not generally known and treated as confidential by a party, including business, financial, statistical, and non-public personal information, trade secrets, know-how, applications, documentation, schematics, procedures, Personally Identifiable Information, information covered by legal privilege, and other proprietary information that may be disclosed or incorporated in materials provided to one party by the other, whether or not designated as confidential, whether or not intentionally or unintentionally disclosed, and whether or not subject to legal protections or restrictions.

Contract Materials: finished or unfinished documents, data, studies, maps, photographs, reports, specifications, lists, manuals, software, and other written or recorded materials produced or acquired by the Contractor pursuant to the Contract for or on behalf of the County, whether or not copyrighted.

Contract: The agreement between the County and Contractor awarded pursuant to this solicitation.

Contractor: The person or other entity awarded a Contract in conformance with the terms of this solicitation and any subsequently agreed upon terms.

County Data: All information, data, and other content, including Confidential Information and other information whether or not made available by the County or the County’s agents, representatives or users, to a Contractor or potential Contractor or their employees, agents, representatives or Subcontractors, and any information, data and content directly derived from the foregoing, including data reflecting user access or use.

County Systems: The information technology infrastructure of the County or any of its designees, including computers, software, databases, networks, and related electronic systems.

County: County of San Mateo

Deliverables: Goods or services required to be provided to the County under the Contract.

Force Majeure: An event or circumstance not caused by or under the control of a party, and beyond the reasonable anticipation of the affected party, which prevents the party from complying with any of its obligations under the Contract, including acts of God, fires, floods, explosions, riots, wars, hurricane, sabotage, terrorism, vandalism, accident, governmental acts, and other events.

Hosting: Storage, maintenance, and management of hardware, software, and the County Data by a party other than the County, on machines and at locations other than those operated by the County, where a party other than the County has regular responsibility for back-up, disaster recovery, security, upgrades, replacement, and overall responsibility for ensuring that all hardware and software continues to function as intended.

Key Employee: Employees of the Contractor jointly identified by the County and the Contractor as possessing unique skill and experience that was a material consideration in the County’s decision to award a contract.

Maintenance Updates: Any revision, update, improvement, modification, enhancement, correction, bug fix, patch, or new release for a system, platform, software or other product, including any change made as a result of applicable federal, State, or local law.

Major Change: A change to the specified performance, maintainability, operation, power requirements, compatibility, measurement, user interface, reliability, quantity, scale, quality, terms, delivery method, or requirement of any product or service that affects the obligations of the parties or reflects a substantial alteration in circumstances surrounding the agreement or is of such a nature that knowledge of the change would affect a person’s decision-making process.

RFP# TSD-20261929 5 Rev 12/15/2025

PII (Personally Identifiable Information): information in any format that can be used to identify a specific individual, either used alone or combined with other private or public information that can be linked in some way to a specific individual.

Project Manager: The individual identified by the County as the County’s primary contact for the receipt and management of the goods and services required under the Contract.

PST: Pacific Standard Time, including Pacific Daylight Time when in effect

Subcontractor: Firms engaged by the Contractor to perform work or provide goods pursuant to the Contract, including vendors and suppliers

Task Order or Purchase Order: A written request from the County to a vendor to provide goods or services, indicating types, quantities, prices and delivery criteria.

RFP# TSD-20261929 6 Rev 12/15/2025

SECTION II - INSTRUCTIONS FOR PROPOSERS

2.1 PRE-SUBMITTAL ACTIVITIES

A. Registration

(1) Organizations or individuals interested in responding to this solicitation must register online with the County at:

https://procurement.opengov.com/portal/smcgov.

(2) The County does not maintain the eProcurement OpenGov system and is not liable for site failures or technical problems. To resolve technical issues, contact OpenGov Technical Support by using the real time chat located in the lower right hand corner of the screen, or via email at procurement-support@opengov.com at:

B. Questions, Comments, Exceptions

Submit questions, comments, and exceptions, including notifications of apparent errors, to the OpenGov site by the Deadline for Questions, Comments and Exceptions. Questions and comments received after the deadline may not be acknowledged.

Request for Substitution of Specified Equipment, Material, or Process

(a) Unless otherwise stated in the solicitation, references to items or processes by trade names, models or catalog numbers are to be regarded as establishing a standard of quality and not construed as limiting competition.

(b) If requesting a substitution for a required item, submit requests by the Deadline for Questions, Comments, and Exceptions. Furnish all necessary information required for the County, in its sole judgement, to make a determination as to the comparative quality and suitability of any suggested alternatives. The County’s decision will be final.

If alternatives are accepted, the County will issue an addendum to the solicitation.

(c) Failure to submit requests by the deadline will be deemed a waiver of any exception.

The County’s consideration of a suggestion does not imply acceptance. If sufficient proposals are received with no requested changes, the County may reject those requesting changes.

C. Revisions to the Solicitation

The County may cancel, revise, or reissue this solicitation, in whole or in part, for any reason. Revisions will be posted as addenda on https://procurement.opengov.com/portal/smcgov. No other revision of this solicitation will be valid. Proposers are responsible for ensuring that they have received all addenda from OpenGov.

D. Contact with County Employees

Violation of the following prohibitions may result in a proposer being found non-responsible, barred from participating in this or future procurements, and becoming subject to other legal penalties.

(1) As of the issuance date of this RFP and continuing until it is canceled or an award is made, no proposer or person acting on behalf of a prospective proposer may discuss any matter relating to the RFP with any officer, agent, or employee of the County, other than through OpenGov, to the Authorized Contact Person, or as outlined in the evaluation or protest procedures.

(2) Proposers may not agree to pay any consideration to any company or person to influence the award of a contract by the County, nor engage in behavior that may be reasonably construed by the public as having the effect or intent of influencing the award of a contract.

https://procurement.opengov.com/portal/smcgov https://procurement.opengov.com/portal/smcgov

RFP# TSD-20261929 7 Rev 12/15/2025

E. Pre-proposal conference and site visits

If a pre-proposal conference or site visit is scheduled, answers to questions raised prior to and at the events may be posted on OpenGov.

2.2 PROPOSAL CONTENT REQUIREMENTS

A. Proposal Format

Number all pages of the proposal. Label and order each section as follows:

(1) Cover letter - no longer than one page

(2) Authorized contacts - identify the name and title the person to contact regarding the proposal, as well as all other individuals authorized to represent the organization in contract negotiations.

(3) Table of Contents, listing all major topics and their respective page numbers.

(4) Exceptions to the solicitation, or to the final revised solicitation, if any. Exceptions must have been submitted by the RFP’s deadline for Comments, Questions, and Exceptions. Exceptions requested after the RFP Deadline for Comments, Questions, and Exceptions will not be considered and/or accepted.

(5) Technical Proposal

(6) Supplementary Documents, as requested

(7) Price Proposal

Proposers are strictly prohibited from submitting internet links (URLs) in place of the required proposal materials. All required information and supporting documents must be included as complete, self-contained files. Submissions that rely on or include links to external files, unless explicitly requested by the County, are considered non-responsive.

B. Technical Proposal Contents

(1) Explain responses to be understood by people unfamiliar with industry jargon. Use drawings, diagrams, schematics, and illustrations as needed, but do not simply refer readers to an exhibit or other section of the proposal in lieu of a complete response.

(2) Addressing each requirement outlined in this solicitation in the order presented, describe how the requested goods and services will be provided.

(3) If applicable or requested, include a project schedule with milestones, deliverables, dates, and a project management plan.

(4) Specify any needs for physical space or equipment that the County must provide during the engagement.

(5) Explain how work, equipment, and knowledge will be transitioned to the County or a new vendor at the end of the contract period.

C. Supplementary Documents

(1) References

(2) Technology Security Assessment, as applicable

(3) Evidence Proposer is Registered, active, and in good standing on sam.gov.

(4) Evidence of insurance, per requirements and minimum coverages listed in Section IV.

(5) All other attachments, certifications, and forms executed as requested.

RFP# TSD-20261929 8 Rev 12/15/2025

D. Price Proposal

(1) Place all cost and pricing data in a separate file clearly marked “PRICE PROPOSAL”.

(2) Use forms and templates provided for the Price Proposal, use them without modification. Failure to use the forms or templates provided, or modification of them, may result in rejection of the entire proposal.

(3) Alternative Price Proposals may be submitted, but only in addition to, not in lieu of, the requested Price Proposal. If submitting an alternative Price Proposal, clearly identify it as an alternative.

(4) Include prices for the base period of service and if applicable, for each additional year including option years.

(5) Unless otherwise indicated, when applicable, in the price of an item, include all licenses required for operation, as well as upgrades and revisions to software over the term.

2.3 PROPOSAL SUBMISSION

A. Submit proposals as directed below.

(1) Electronic Submissions

Include the proposer’s name and the RFP title and number in each filename. Submit proposals via the OpenGov website, allowing sufficient time for the upload to complete by the Due Date and Time.

Partial uploads will automatically terminate, and proposals will be rejected. The OpenGov submission time will be the official submission time. Contact OpenGov with technical questions regarding the site. The County will not be responsible for and may not accept proposals that are late due to slow internet connections or for any other failure of the OpenGov system.

(2) Conflicts between Certain Requirements

Prior to the submission deadlines and solely relating to a determination of the timeliness of questions, comments, and proposal submissions, information displayed on the OpenGov site will take precedence in the event of a discrepancy between that information and the information within the solicitation documents. For all other discrepancies, the information in the solicitation documents will take precedence.

(3) Hand-written responses, whether or not submitted electronically, will be rejected, with the exception that signatures may be hand-written.

B. Errors in Proposals

The County will not be liable for any errors in proposals. Proposals may be rejected as unresponsive if they are incomplete, are missing pages or information, or cannot be opened for any reason. The County may waive minor irregularities, but such waiver will not modify any remaining RFP requirements.

2.4 PROPOSER CERTIFICATIONS

By submitting a proposal, each proposer certifies under penalty of perjury that:

• Its submission is not the result of collusion or any other activity that would tend to directly or indirectly influence the selection process; and

• Proposer is able to comply with all requirements of this solicitation at the time of proposal submission;

and

• Neither proposer, its employees, nor any affiliated firm providing the requested goods and services has prepared plans, specifications, terms or requirements for this solicitation, or has any other actual or potential conflict of interest; and

RFP# TSD-20261929 9 Rev 12/15/2025

• Proposer is aware of the provisions of Section 1090 et seq. and Section 87100 et seq. of the California Government Code relating to conflict of interest of public officers and employees and is unaware of any financial or economic interest of any County officer or employee relating to this solicitation.

2.5 PROCUREMENT PREFERENCE FOR LOCAL BUSINESS AND LOCAL NON-PROFITS

The County of San Mateo has adopted a Procurement Preference for Local Businesses Ordinance (County Ord.

Code Ch. 2.89.) The purpose of this Ordinance is to promote a strong local economy by giving preference to local businesses, local non-profits, local small and micro businesses, and local small and micro non-profits in County procurements, to the extent consistent with the law and interests of the public. The County’s process for applying local preferences to competitive procurements is set forth in County Ordinance Code Section 2.89.030. The Ordinance and exemptions (e.g. the ordinance will be exempt when all bids or proposals received are from Non- Profit Organizations) can be reviewed here:

Chapter 2.89 - PROCUREMENT PREFERENCE FOR LOCAL BUSINESSES | Code of Ordinances | San Mateo County, CA | Municode Library

The requirements for bidders to establish eligibility for a local preference for this solicitation are detailed in Section

3.2. The Ordinance does not apply if a procurement is determined to be exempt (County Ord. Code sec. 2.89.050), and the County reserves the right to waive application of the Ordinance to this procurement if determined to be in the best interests of the County (County Ord. Code sec. 2.89.060).

2.6 WITHDRAWAL OF PROPOSALS

Proposals may be withdrawn, modified, or replaced at any time prior to the Due Date and Time. After that time, whether or not a new solicitation is issued for the same subject matter, withdrawal of a proposal may preclude the proposer from participating in the procurement as a proposer or subcontractor, except that an original equipment manufacturer may participate indirectly through a reseller.

2.7 NO COMMITMENT

Neither submission of a proposal nor the County’s receipt of proposal materials confers any right to the proposer nor any obligation on the County. This RFP does not commit the County to award a contract, nor will the County defray any costs incurred in preparing proposals or participating in any presentations or negotiations.

2.8 ESTIMATED QUANTITIES

If the solicitation results in an indefinite quantity or a requirements Agreement, the goods and services actually requested by the County may be less than the maximum value of the Agreement and there is no guarantee, either expressed or implied, as to the actual quantity of goods and services that will be authorized under the Agreement.

2.9 PROPOSER SELECTION

At any time in the evaluation process, the County may request clarifications from proposers.

A. Determination of Responsiveness

A responsive proposal conforms to the instructions set forth in this solicitation and any modifications to it.

B. Proposal Evaluation

The County will establish an evaluation committee which will evaluate responsive proposals based on the criteria specified in the solicitation. The committee may then recommend one or more top-ranked proposers for final negotiation of contract terms or may invite one or more proposers for oral presentations and demonstrations, following which those proposers may be allowed to amend their proposals. After evaluating presentations and amended proposals, the committee may recommend one or more top-ranked proposers for final negotiation of contract terms.

https://library.municode.com/ca/san_mateo_county/codes/code_of_ordinances?nodeId=TIT2AD_ART2.8INFIPRCOCO_CH2.89PRPRLOBU https://library.municode.com/ca/san_mateo_county/codes/code_of_ordinances?nodeId=TIT2AD_ART2.8INFIPRCOCO_CH2.89PRPRLOBU

RFP# TSD-20261929 10 Rev 12/15/2025

C. Determination of Responsibility

The County will make a determination of the responsibility of any proposer under consideration for award, taking into consideration matters such as the proposer’s integrity, compliance with public policy and laws, past performance, fiscal responsibility, trustworthiness, financial and technical resources, capacity, and experience to satisfactorily carry out its responsibilities.

By submitting a proposal, the proposer certifies that, to the best of its knowledge, the proposer maintains financial resources sufficient to satisfy the terms of the proposed project, if awarded.

2.10 CONTRACT AWARD

A. Notice of Intent to Award

Once a decision has been made to award a contract to one or more proposers, the County will post a Notice of Intent to Award, notifying the remaining proposers of their non-selection. The posting may be inclusion of the recommendation to award as an agenda item on the Board of Supervisors schedule.

B. Award Procedure

Contract negotiations are neither an offer nor an implicit guarantee that a contract will be executed.

Award, if made, will be to the responsive, responsible proposer offering the overall best value to the County for the services and goods described in this solicitation, or as applicable, for a specific portion of the services and goods described. Any agreement reached will be memorialized in a formal agreement using the attached Standard Agreement template.

C. Commencement of Performance

After all parties have signed the Agreement, the County will notify the proposer and performance may proceed. Prior to County execution of the Agreement, no County employee may authorize work. Any work performed prior to that time may be uncompensated.

D. Levine Act Disclosure

The Levine Act (California Government Code Section 84308) imposes certain requirements on parties contracting with the County of San Mateo related to campaign contributions to County “officers,” including elected County officers and candidates seeking elective office, who may participate in making a decision on certain County contracts. Elected County officers in San Mateo County include: the San Mateo County Board of Supervisors, Assessor-County Clerk-Recorder, County Controller, Coroner, District Attorney, Sheriff, and Tax Collector-Treasurer. Generally, under current County policy, approval by the Board of Supervisors is required for any agreement for services above $200,000, and agreements for services below that threshold may be approved by Department heads. If your proposal is selected, you will be required to certify compliance with the Levine Act. As part of this process, you will need to certify and warrant that you have fully complied, and will remain in full compliance, with all applicable requirements of the Levine Act in connection with the Agreement, including making any required disclosures of campaign contributions to County Officers, which includes but may not be limited to elected County Officers. Elected County Officers include members of the San Mateo County Board of Supervisors, as well as the Assessor- County Clerk-Recorder, Controller, Coroner, District Attorney, Sheriff, and Tax Collector-Treasurer. Any campaign contribution required to be disclosed under the Levine Act in connection with this Agreement shall be disclosed on the County of San Mateo Levine Act Disclosure Form, a copy of which is available from the County upon request. Parties are solely responsible for accurate certification and disclosure. The Levine Act is complex, and this brief description is not legal advice. For example, certain contributions must be aggregated when determining whether contributions have exceeded the $500 threshold. If your proposal is selected, you are urged to review the Levine Act and consider consulting an attorney.

2.11 PROTESTS

Protests that do not comply with the protest procedures outlined below will be rejected.

RFP# TSD-20261929 11 Rev 12/15/2025

A. Protest Eligibility, Format, and Address

(1) Protests or objections may be filed regarding the selection process and/or the defective content of the solicitation or any addenda.

(2) In accordance with Sections B and C below, the County will only review protests submitted by an interested party, defined as an actual or prospective proposer to this solicitation whose direct economic interest could be affected by the County’s conduct of the solicitation. Subcontractors do not qualify as interested parties.

(3) Submit protests by e-mail to ISD_Protest_Officer@smcgov.org.

B. Protest Deadlines

Submit protests with any supplemental materials by 5 p.m. PST, as appropriate, on the deadlines set forth below. The date of filing is the date the County receives the protest, unless received after 5 p.m. PST, or on other than a Business Day, in which case the date of filing will be the next Business Day. Failure to file by the relevant deadline constitutes a waiver of any protest on those grounds. Supplemental materials filed after the relevant deadline will be rejected by the County.

If relating to the defective content of the solicitation or to an addendum, file within five Business Days after the date the County releases the solicitation or addendum.

C. Protest Contents

(1) The letter of protest must include all of the following elements:

(a) Detailed grounds for the protest, fully supported with technical data, test results, documentary evidence, names of witnesses, and other pertinent information related to the subject being protested; and

(b) The law, rule, regulation, ordinance, provision or policy upon which the protest is based, with an explanation of the violation.

(2) Protests that simply disagree with decisions of the Evaluation Committee will be rejected.

(3) Except for protests related to defective content filed by the relevant deadline, protests from parties who did not submit a proposal prior to the proposal due date and time will be rejected.

D. Reply to Protest

The County will send a written response to the protestor and to any other party named in the protest.

E. No Stay of Procurement Action during Protest

Nothing in these protest requirements will prevent the County from proceeding with negotiations or awarding a purchase order or contract while a protest is pending.

2.12 PUBLIC RECORDS

A. General

(1) All proposals, protests, and information submitted in response to this solicitation will become the property of the County and will be considered public records. As such, they may be subject to public review.

(2) Any contract arising from this RFP will be a public record.

(3) Submission of any materials in response to this RFP constitutes:

(a) Consent to the County’s release of such materials under the Public Records Act without notice to the person or entity submitting the materials; and

(b) Waiver of all claims against the County and/or its officers, agents, or employees that the County has violated a proposer's right to privacy, disclosed trade secrets, or caused any damage by allowing the proposal or materials to be inspected; and mailto:ISD_Protest_Officer@smcgov.org

RFP# TSD-20261929 12 Rev 12/15/2025

(c) Agreement to indemnify and hold harmless the County for release of such information under the Public Records Act; and

(d) Acknowledgement that the County will not assert any privileges that may exist on behalf of the person or entity submitting the materials.

RFP# TSD-20261929 13 Rev 12/15/2025

SECTION III - QUALIFICATIONS, EXPERIENCE, AND EVALUATION CRITERIA

3.1 MINIMUM QUALIFICATIONS

Proposals will be accepted only from proposers that meet the following required minimum qualifications and requirements at the time of proposal submission. Proposals that fail to meet these criteria are considered non-responsive and are ineligible for consideration.

Minimum Qualifications and Requirements of Proposed Platform(s):

• Minimum five (5) years operating in a production environment and supporting government customers with the requirements detailed in this RFP.

Minimum Qualifications and Requirements of Proposer(s):

• The proposer has a minimum three (3) years’ experience implementing the proposed solution(s), performing similar services as those detailed in this RFP.

• The proposer has completed at minimum three (3) successful implementations for government agencies of similar size and requirements within the last five (5) years.

• Provide evidence of the insurance requirements and coverage limits for each of the checked categories as outlined in Section IV-Insurance. Expired certificates will not meet this requirement.

• Provide evidence the proposer is registered, active, and in good standing with sam.gov and is not barred from public contracting by any federal or state authority. Incomplete registrations will not meet this requirement.

3.2 PROCUREMENT PREFERENCE FOR LOCAL BUSINESSES AND LOCAL NON-PROFITS

A. Is the Proposer a “Local Business”?

As Defined by Chapter 2.89.020 of the San Mateo County Ordinance Code, a “Local Business” means any for-profit business which has its principal place of business, or is headquartered, in San Mateo County. If this designation applies to the proposer, a self-attestation form must be completed and provided with this response.

Please download the self-attestation form, complete, and include in the submission. If this designation is not applicable, please leave blank.

B. Is the Proposer a Non-Profit?

A Non-Profit is defined as a tax-exempt public charity organization (within the meaning of section 501(c)(3) of the Internal Revenue Code) that is formed for purposes other than making a profit, is exempt from paying federal income taxes on the income generated for their exempt purposes.

(1) If yes, is the Proposer a “Local Non-Profit”?

As Defined by Chapter 2.89.020 of the San Mateo County Ordinance Code, a “Local Non-Profit" means a tax-exempt public charity organization (within the meaning of section 501(c)(3) of the Internal Revenue Code) that is formed for purposes other than making a profit, is exempt from paying federal income taxes on the income generated for their exempt purposes, and has its principal place of business, or is headquartered, in San Mateo County. If this designation applies to the proposer, a self-attestation form must be completed and provided with this response.

Please download the self-attestation form, complete, and include in the submission. If this designation is not applicable, please leave blank.

C. Is the Proposer a Local “Small” or “Micro” Business?

As Defined by Chapter 2.89.020 of the San Mateo County Ordinance Code:

RFP# TSD-20261929 14 Rev 12/15/2025

“Small Business” means any business which holds a Small Business Certification awarded by the California Office of Small Business and Disabled Veteran Business Enterprise Services (OSDS).

“Micro Business” means any Small Business certified by the OSDS which is automatically designated by the OSDS as a Micro Business due to gross annual receipts falling below the OSDS-designated dollar amount.

If the above designations apply, please provide the OSDS provided Certification ID.

If this designation is not applicable, please leave blank.

D. Is the Proposer a Local “Small” or “Micro” Non-Profit?

As Defined by Chapter 2.89.020 of the San Mateo County Ordinance Code:

“Small Non-Profit" means a Local Non-Profit with an annual revenue of $1,000,000 to $2,500,000 according to its most recently filed IRS Form 990.

“Micro Non-Profit" means a Local Non-Profit with an annual revenue of less than $1,000,000, according to its most recently filed IRS Form 990.

If the above designations apply, please provide your latest filed IRS form 990. A filing from the last two calendar years is acceptable.

If this designation is not applicable, please leave blank.

3.3 ORGANIZATIONAL CAPACITY AND EXPERIENCE

A. Organizational Capacity:

(1) Titles and names of staff members who will be on the team responsible for the project, as well as the expected availability of the various individuals. If requested, include the resume of a dedicated, full-time project manager.

(2) All applicable licenses and license numbers relevant to the project, the names of the holders of those licenses, and the names of the agencies issuing the licenses.

B. Experience

(1) The number of years providing services similar to those contemplated

(2) The number of years providing services to government entities

3.4 REFERENCES

Provide at least three references from successfully completed projects of similar nature to that described in this solicitation, including the name of the organization for which work was performed, and the name, phone number, and e-mail address of an individual at the organization who was responsible for managing and accepting the work.

Ensure that contact information is current. If the County cannot contact the reference because of incorrect or out-of-date information, the reference will be deemed not to have been provided. References cannot include the County of San Mateo or any employees thereof.

3.5 EVALUATION CRITERIA

Proposals will be evaluated in accordance with the following evaluation criteria:

Phase I: Evaluation of Technical Proposal

45% - Method and approach

• Apparent understanding of the scope of services to be provided

• Appropriateness of the proposed solution/services

30% - Experience and organizational capacity

• Qualifications and experience of both the proposer and key personnel

RFP# TSD-20261929 15 Rev 12/15/2025

• Experience with other public agencies

• Organizational resources and staff, apparent ability to meet any required timelines or other requirements

25% - Price

10% Preferential Points

Where price is not the sole evaluation factor for a solicitation (e.g., in the case of a "best-value" solicitation), five percent (5%) of the total evaluation points awardable will be added to the proposal score for each Local Business or Local Non-Profit score for evaluation purposes. In the event of a tie between a Local Business or Local Non-Profit and another bidder, the Local Business or Non-Profit shall be awarded the Contract, assuming agreement on other contract terms.

An additional three percent (3%) preference shall be given to a Local Business or Local Non-profit (for a total of eight percent (8%) of total points awardable) if the proposer is a Small Business or Small Non-Profit, or an additional 5 percent preference (for a total of ten percent (10%) of total points awardable) if the proposer is a Micro Business or Micro Non-Profit.

Phase II: Evaluation of Demonstration/Interviews of elevated proposals

100%- Demonstration

• Ability to fully integrate user population through SAML

• Education and campaign reporting platforms

• Ability to report success failure by population groups, minimum of 30 (departments, divisions etc.)

• Ability to setup training and testing campaigns based on specific types of content, i.e.

PII/HIPAA/CJI

• Ability to select topics to generate a continuous security awareness training video including ease of use.

• Vendor must demonstrate a variety of current topics to select from that would be applicable to various levels of training.

• Demonstration must include available phishing campaigns, ease of use in setting up, include sample phishing emails, and reporting information.

• Security awareness campaign must demonstrate risk areas and suggested areas of improvement.

RFP# TSD-20261929 16 Rev 12/15/2025

SECTION IV - INSURANCE

Include evidence of insurance in your proposal submission for each of the checked categories.

General Liability (Including operations, products and completed operations, as applicable.)

$1,000,000 - per occurrence for bodily injury, personal injury and property damage. If Commercial General Liability Insurance or other form with a general aggregate limit is used, the general aggregate limit either must apply separately to this project or must be twice the required occurrence limit.

To be carried at all times during the term of the Contract

☒ Automobile Liability

$1,000,000 - per accident for bodily injury and property damage.

To be carried at all times during the term of the Contract

☒ Workers’ Compensation As required by the State of California

To be carried at all times during the term of the Contract

☒ Employers’ Liability

$1,000,000 - each accident, $1,000,000 policy limit bodily injury by disease, $1,000,000 each employee bodily injury by disease.

To be carried at all times during the term of the Contract

☐ Professional Liability (Errors and Omissions)

$1,000,000 - per occurrence.

To be carried at all times during the term of the Contract

☐ Cyber Liability

$5,000,000 per occurrence for Privacy and Network Security, $1,000,000 per occurrence for Technology Errors and Omissions

To be carried at all times during the term of the Contract and for three years thereafter.

4.1 SPECIAL INSURANCE REQUIREMENTS - CYBER LIABILITY

If the work involves services or goods related to computers, networks, systems, storage, or access to County data or to any data that may, alone or in combination with other data, become Confidential Information or Personally Identifiable Information, the following insurance is required.

(1) Privacy and Network Security

During the term of the Contract and for three years thereafter, maintain coverage for liability and remediation arising out of unauthorized use of or access to County data or software within Contractor’s network or control. Provide coverage for liability claims, computer theft, extortion, network breach, service denial, introduction of malicious code, loss of Confidential Information, or any unintentional act, error, or omission made by users of Contractor’s electronic data or systems while providing services to the County. The insurance policy must include coverage for regulatory and PCI fines and penalties, crisis management expenses, and business interruption. No exclusion/restriction for unencrypted portable devices/media may be on the policy.

(2) Technology Errors and Omissions

During the term of the Contract and for three years thereafter, maintain coverage for liabilities arising from errors, omissions, or negligent acts in rendering or failing to render computer or

RFP# TSD-20261929 17 Rev 12/15/2025 information technology services and technology products, including at a minimum, coverage for systems analysis, design, development, integration, modification, maintenance, repair, management, or outsourcing any of the foregoing.

RFP# TSD-20261929 18 Rev 12/15/2025

SECTION V - STANDARD TERMS AND CONDITIONS

Note to proposers: These are attached for information only. Do not complete this form. The final agreement between the County and any successful proposer will be based on this template.

See Attachment D - County Standard Contract Template

Please note that the redline requests by proposer are for review by County only. Proposers should not rely on the County’s agreement to modified terms.

RFP# TSD-20261929 19 Rev 12/15/2025

SECTION VI - SCOPE OF WORK AND SPECIAL PROVISIONS

6.1 SUMMARY

The County is seeking proposals from well-qualified proposers to supply a software system to educate its users on best practice security awareness as well as provide an integrated testing platform to educate users on recognizing phishing, spoofing and business email compromise (BEC) attacks through commonly used platforms such as email.

The County’s goal is to employ a multi-channel, context-specific, and workforce member-centric approach to security awareness education for approximately 9,000 participants annually. The intended outcome is to heighten user mindfulness of the tactics used by bad actors to infiltrate the corporate computing environment and to deceive workforce members into providing information that will enable such infiltration. The intended outcome will drive user security education and provide robust and relevant content and testing services that support behavior change and awareness.

The County also desires that the platform provide regulatory training and testing specific to certain federally regulated areas such as the Health Insurance Portability and Accountability Act (HIPAA) and the Criminal Justice Information Services (CJIS). Training categories should also include education on proper handling of Personally Identifiable Information (PII) and Protected Health Information (PHI).

It is the intent of the County to implement a continuous learning approach to security awareness. This requires that the platform provide content that is capable of quickly providing information and training on evolving threats as well as up to date best practices. designed to fit various communication venues such as email tags, Intranet articles of interest.

Proposals will be fully responsive to the documentation, descriptions, and specifications contained in this RFP. The successful proposer will be singularly responsible for the proposed solution and will not use subcontractors to perform the services.

6.2 PERFORMANCE MEASURE

Successful completion of implementation of all functionality by date noted in respondents RFP response.

6.3 REQUIREMENTS AND SCOPE OF WORK

Proposals must include comprehensive details on how their submission meets each requirement.

Instructional Content:

1. The platform solution must be able to provide security media using diverse modalities, including posters, videos, and configurable email-based tips.

2. Ability to create custom content, including unique multi-media content, which can be uploaded and integrated into the education platform. Custom content must be able to be delivered via SCORM in a continuous format.

1. This function should also have the capability of inserting or customizing quizzes, user challenges and graded questions within the custom content.

2. Custom content must be capable of being delivered in a continuous format without breaks

3. Ability to brand content and append content with disclaimers (or additional information) meant to enhance the relevance of the training with County policy or guideline information and references.

4. The vendor solution should be able to provide different levels of training (basic users, intermediate, IT professionals, management). The training for different levels must include a variety of content and options.

5. Content delivery format and length should be varied, from micro training of ~5 minutes to more comprehensive training lasting 30-45 minutes or more.

6. Training subjects should include a broad menu of options including a variety of information on security attack types and security threats. Defined training on the meaning of security terms and attack types such as, but not limited to, denial of service attacks (DDOS), man in the middle (MIM) attacks, recognizing business email compromise (BEC) attacks, dark web monitoring, fraudulent source emails such as

RFP# TSD-20261929 20 Rev 12/15/2025 spoofing, social engineering, account takeover attempts, impersonations, password security, and various forms of electronic fraud.

1. Training should also include information on acceptable employee actions when suspected attacks are occurring as well as the potential consequences of inaction and possible impacts.

7. Ability to create training campaigns and validate training effectiveness through direct phishing, BEC, impersonation simulations.

1. Ability to establish groups and assign training based on responsibilities or knowledge requirements.

8. Platform should incorporate modern techniques of immersive user interaction including gamification, and fully interactive scenario-based training that resonates with users to maximize content delivery and retention.

9. Platform should deliver measurable behavior change.

10. Ability to decentralize management of training and phishing campaigns by department in a tenant-like environment or through role-based access controlled (RBAC) environment while also maintaining the role of platform wide administration and reporting.

11. The County requires all contractors and workforce members to undergo training and testing. Therefore, integrations with Active Directory via SAML and/or the ability to register users outside of the organization are required.

12. Content should be sharable to the County's LMS with the support of the Sharable Content Object Reference Model (SCORM).

13. The content provided by the vendor should have frequent and consistent updates to avoid repetitive or stale instructional material including current real-world cyber threats.

1. Updates should be on relevant topics including knowledge-based information on attack types and security threats.

14. Vendors should demonstrate content relevance to the County’s unique workforce environment.

Phishing and Testing Platform functionality:

1. Provide realistic phishing and other social engineering attack simulations.

2. The ability to randomize campaigns within a date range and randomize phishing tests across a department, division, or work teams as defined within Active Directory.

3. Platform should provide broad phishing variations based on real-world phishing attacks.

1. Phishing outcomes for users when phished should be informative.

4. Platform should provide suggested areas for improvement based on test results.

5. Provide specific content pertinent to government needs or standard local governmental processes.

6. A comprehensive reporting function that can be segmented by departments, divisions, and work teams.

1. Reporting function should have the ability to provide statistical comparisons with previously completed educational and phishing campaign outcomes.

2. Dashboards and reports should be able to provide comparative statistical data to defined industries.

7. The platform should have the ability to identify and report on repeat success or failure at the individual user level and apply a risk score based on historical compliance and testing outcomes.

8. Provide phishing notification button to report phishing and suspicious email in Outlook.

Training Reports:

1. Comprehensive reporting to include completion rates as well as trending reports to the department level.

Reporting should also be available in dashboard form suitable for publication either through HTML extensions intended to publish this information in interaction form to the County Intranet (SharePoint) or shared through other platforms in file form. Public facing dashboards should have the ability to publish only raw numbers and without usernames.

2. Reporting capabilities include grading and feedback mechanisms to gauge understanding of subject matter.

3. Reporting results should provide ability to determine knowledge gaps with suggested training.

4. Reporting data must remain secure and only accessible to specific assigned groups or individuals.

RFP# TSD-20261929 21 Rev 12/15/2025

5. Integration with OpenSesame to maintain employee training results.

All proposals should include sample reports.

All platform features and functions should be compatible with mobile devices and various operating systems such as iOS and Android.

6.4 FINGERPRINTING AND BACKGROUND CHECKS

In some instances, it may be required if the proposed contract requires access to certain sensitive groups or proprietary materials. Fingerprinting and background checks are administered at the discretion of the County based on project and/or contract requirements. The vendor must provide the County with confirmation when the fingerprinting and background checks have cleared.