Cyber_Security_Managed_Services.pdf

CITY OF SANTA MONICA

CYBER SECURITY MANAGED SERVICES

Information Services Department

RELEASE DATE: September 22, 2025

DEADLINE FOR QUESTIONS: September 29, 2025

RESPONSE DEADLINE: October 24, 2025, 3:00 pm

APPROVED FOR ADVERTISEMENT

City of Santa Monica

Cyber Security Managed Services

Table of Contents

1. Introduction

2. Term

3. Scope of Work

4. Questions and Answers

5. Vendor Questionnaire

6. Evaluation Criteria

7. Award Process

8. Terms & Conditions

Attachments:

A - Proposer Checklist

B - PSA Template

C - Cyber Security Insurance Requirements

Cyber Security Managed Services

1 Introduction

1.1 Summary

The City of Santa Monica is inviting qualified firms to provide Cybersecurity Managed Services in order to enhance the security of the City's network, systems, and applications.

1.2 Background

The City operates a complex IT environment, managing approximately 8,000 devices/IPs, a variety of business applications, and a hybrid infrastructure of on-premises and cloud-based systems that support the delivery of critical services to Santa Monica residents and businesses. As cyber threats continue to grow in sophistication and persistence, it is essential for the City to take proactive measures to safeguard its digital infrastructure and minimize exposure to potential cyberattacks.

A successful proposal will outline a comprehensive approach to assessing the City’s security risks, identifying vulnerabilities, and implementing effective remediation strategies. The ideal firm would demonstrate expertise in real-world attack scenarios, effective defense strategies, and tailored recommendations that align with the City's unique IT environment and risk profile, while also possessing the capability to deliver both the core and optional services outlined in the scope of work.

1.3 Contact Information

Any inquiries or requests regarding this procurement should be submitted via OpenGov. Other City officers, agents, employees or representatives do not have authority to respond on behalf of the City. Contact with unauthorized City personnel during the selection process may result in disqualification.

Denise Mixon Senior Buyer 1685 Main Street, Mail Stop 09 Santa Monica, CA 90401 Email: denise.mixon@santamonica.gov Phone: (310) 458-2211 Department:

Information Services Department

Department Head:

mailto:denise.mixon@santamonica.gov tel:(310)458-2211

Cyber Security Managed Services

1.4 Timeline

Proposal Calendar

The following is a list of key dates:

Release Project Date September 22, 2025

Question Submission Deadline September 29, 2025, 3:00pm

Question Response Deadline October 13, 2025, 5:00pm

Proposal Submission Deadline October 24, 2025, 3:00pm

2 Term

The City is inviting proposals from qualified persons or firms for a firm-fixed contract for an initial term of five (5) years, with two (2) options for renewal of one (1) year each, to be exercised at the City’s sole discretion.

3 Scope of Work

Vendor shall deliver comprehensive cybersecurity services, including penetration testing, risk assessments, security policy review, incident response exercises, and ongoing security management; act as a strategic partner, providing both one-time deliverables, such as the initial citywide cybersecurity assessment, other elements, such as penetration testing, tabletop exercises, and incident response support, are expected to occur annually or as needed over the life of the agreement.

Many services, particularly assessments and frameworks, will require multi-year implementation, while others are anticipated to recur annually.

3.1 Scope of Work

The City expects the selected vendor to act as a strategic partner, providing both one-time deliverables and ongoing services that the support the City's evolving cybersecurity needs over the term of the contract. Many services, particularly assessments and frameworks, will require multi-year implementation, while others are anticipated to recur annually.

Penetration Testing Services

This is a recurring annual service. A follow-up test after remediation is required as part of the annual engagement.

Cyber Security Managed Services

A. Provide penetration testing services, including but not limited to:

1. Develop a detailed plan of testing protocols and timelines in collaboration with the City’s Information Security team.

2. Conduct internal network penetration testing (approximately 8000 devices/IPs), starting with unauthenticated testing and progressing to authenticated testing if required.

3. Test wireless networks.

4. Conduct penetration tests on other identified security vulnerabilities.

B. Upon completion of testing, provide a Penetration Testing Report containing but not limited to the following information:

1. Executive summary of findings

2. Detailed documentation of all findings and testing

3. Classification of findings based on industry standard risk models

4. Remediation recommendations for findings

A.

Cybersecurity Assessment

This is a multi-phase assessment that includes an initial evaluation followed by a reassessment after remediation efforts. The full assessment process is expected to take place over the course of the contract term.

A. Perform a comprehensive Cybersecurity Assessment to define the City's cybersecurity landscape and associated risks at the strategic level. This assessment will guide resource allocation and prioritize citywide and departmental efforts to address vulnerabilities, threats, and consequences.

1. The assessment will cover all City departments, with an initial focus on:

a. Public Safety: Police, Fire, and Emergency Management

b. Public Works: Water Service (SCADA)

c. Department of Transportation

2. The assessment deliverables will include:

a. Identification of key cybersecurity risks across departments

b. Prioritization of risks based on impact and likelihood

c. Recommendations for mitigation strategies

d. Comparative analysis of initial vs. follow-up results (as applicable)

Cyber Security Managed Services

Cybersecurity Tabletop Exercise

One large scale exercise will be conducted each year, incorporating key City departments and executive leadership.

A. Plan, Schedule, and Conduct annual Cybersecurity Tabletop Exercises with ISD and other designated City staff which must include, but is not limited to:

1. Design the exercise based on current real world Cybersecurity Incidents

2. Lead the exercise

3. Provide a post-mortem report with recommendations for improvement

Disaster Recovery and Incident Response

The vendor is expected to provide support on an ongoing basis throughout the term, assisting with updates exercises, and post-event reviews as needed.

A. Review and update the Disaster Recovery (DR) Plan, ensuring alignment with industry best practices.

B. Assist the City in performing a DR exercise

C. Support post-exercise analysis and improvements

D. Develop an Incident Response (IR) Plan, including:

1. Conducting a Tabletop IR Exercise

2. Providing post-exercise analysis and recommendations

Risk Management

This is a multi-year engagement to build and mature the City's cybersecurity efforts over the life of the contract. Deliverables and scheduling will be developed in collaboration with the City's Information Security team

A. Develop a Third-Party Risk Management Program to assess and mitigate cybersecurity risks associated with external vendors, suppliers, and service providers. This program will include:

1. Risk assessment of third-party entities handling City data

2. Evaluation of emerging threats, including risks associated with AI and Generative AI (Gen AI)

Risk Acceptance Framework

This is a multi-year engagement to build and mature the City's cybersecurity efforts over the life of the contract. Deliverables and scheduling will be developed in collaboration with the City's Information Security team

A. Establish a framework for evaluating and accepting risks related to:

1. New technologies and technology initiatives

2. Legacy systems and technical debt (in coordination with the Business Application and Risk Review process)

Cyber Security Managed Services

Business Application and Risk Review

This is a multi-year engagement to build and mature the City's cybersecurity efforts over the life of the contract. Deliverables and scheduling will be developed in collaboration with the City's Information Security team

A. Conduct security risk assessments for key business applications and systems used by the City.

B. Identify vulnerabilities and assess potential security risks associated with these applications.

C. Provide recommendations for risk mitigation, including best practices for securing applications.

D. Work with City’s Information Security team to prioritize applications for review based on risk factors.

E. Provide a report summarizing risk levels, vulnerabilities, and recommended security controls.

F. Review and update the Disaster Recovery and Business Continuity Plans based on these findings.

3.2 Scope of Work (Optional)

Cybersecurity Training and Phishing Simulation Management

A. Assist the City Information Security and other ISD staff managing phishing simulations and cybersecurity training

1. The City currently utilizes KnowBe4 for phishing simulations and cybersecurity training, but that may change in the future.

2. Configuring the phishing simulations

3. Assigning cybersecurity training to users

A.

A.

a. New hire training

b. Yearly Cybersecurity Awareness Month (October)

A. Provide reports on simulation results

B. Provide reports on training status

1.

Vulnerability Management Services

Cyber Security Managed Services

A. Manage and operate the City's Vulnerability Scanning system

B. Work with the City's Information Security team to define and implement a vulnerability scan schedule

C. Provide scheduled and ad-hoc vulnerability reports for specific City resources

D. Provide detailed remediation guidance

Web Application Penetration Testing

A. Provide optional web application penetration testing services

Security Policy Review

A. Annual Review and Update of Information Security Policy

B. Acceptable Use Policy Review and Update

C. Privacy Policy Creation

D. Other Policies as Needed

Cybersecurity Grant Management

A. Suggest and assist with cybersecurity grant opportunities

B. Develop a grant application process and train ISD staff when necessary

C. Maintain a database of available cybersecurity grants

D. Deliverables to include grant application paperwork and a list of potential grants

3.3 Assumptions

A. The City will assign a project lead to coordinate vendor access, department scheduling, and review of deliverables.

B. Some services will require coordination with multiple departments and may be scheduled over time, depending on operational availability.

C. The city expects the vendor to adjust priorities and deliverables as needed through the contract term.

D. The scope of work may evolve based on emerging risks or technologies. Any material changes will be mutually agreed upon and documented.

E. The City expects the vendor to assign personnel with relevant technology expertise for each area of engagement, ensuring specialized knowledge is applied to address the distinct systems, infrastructure, and operational needs across City departments.

Cyber Security Managed Services

F. The City reserves the right to review and approve vendor personnel prior to their assignment to City projects.

G. The City must be notified in advance and reserves the right to approve any changes to assigned vendor personnel.

3.4 Vendor Requirements

Firms must clearly demonstrate their ability to meet these requirements in their proposal responses, especially within the Vendor Questionnaire.

A. Minimum of five (5) years of experience, both government (primary) and private (secondary) providing managed cybersecurity services, including penetration testing, vulnerability management, and security risk assessments

B. Proven experience working with municipal governments or public sector agencies, demonstrating knowledge of regulatory and compliance requirements applicable to local government cybersecurity.

C. Staff consisting of Qualified cybersecurity professionals, including Certified Ethical Hackers (CEH), Offensive Security Certified Professionals (OSCP), CISSPs, or equivalent certifications.

D. Expertise in real-world attack simulation, advanced threat detection, and incident response strategies.

E. Strong understanding of NIST Cybersecurity Framework (CSF), CIS Controls, ISO 27001, CJIS, CCPA, HIPAA, PCI, and other relevant cybersecurity standards.

F. Knowledge of data protection and privacy regulations applicable to local government operations.\

G. A summary of similar projects, particularly for municipal or public sector clients

H. Certifications and roles of proposed personnel

I. Methodologies used for penetration testing, risk assessments, and other core services

J. Familiarity with applicable standards (e.g., NIST CSF, CIS Controls, ISO 27001)

K. Descriptions of similar work performed, particularly with municipal or public sector clients.

Cyber Security Managed Services

4 Questions and Answers

Vendor Queries Due Questions must be submitted online in the “Q&A” tab. The City will only accept or respond to questions submitted through the online vendor portal.

One question per submittal. (This does not mean one question per vendor.) Submittals containing multiple questions will not be answered.

5 Vendor Questionnaire

5.1 Proposal

5.1.1 Letter of Transmittal*

Please upload your letter of Transmittal as a PDF here. Make sure to include the following items.

A. Identify the submitting organization;

B. Identify the name, title, telephone and fax numbers, and e-mail address of the person authorized by the organization to contractually obligate the organization;

C. Identify the name, title, telephone and fax numbers, and e-mail address of the person authorized to negotiate the contract on behalf of the organization;

D. Identify the names, titles, telephone and fax numbers, and e-mail addresses of persons to be contacted for clarification;

E. Be signed by the person authorized to contractually obligate the organization;

F. Acknowledge receipt of any and all amendments to this RFP.

*Response required

5.1.2 Qualifications*

Provide a brief summary of your company’s history, its capabilities, and its recent relevant experience (last five years). Also, describe your demonstrated experience with similar projects and qualification including professional licenses and certifications.

*Response required

5.1.3 Key Personnel*

Describe the project team composition and include resumes of key personnel. Proposed members should be available for the duration of the contract. The City must be promptly notified of any changes in key personnel prior to award.

*Response required

Cyber Security Managed Services

5.1.4 References*

List a minimum of three (3) references for whom comparable services with government clients were provided to in the last five (5) years. Include the name of the firm, name of the contact, telephone number of the contact, email address of contact (if available), brief description of the services provided and your firm’s role, and the start and completion date.

*Response required

5.1.5 Project Work Plan*

Describe your understanding of the project and approach. Include deliverables, milestones, assumptions, and identify potential risks that could delay the project. List any resources you expect the City to provide.

*Response required

5.1.6 Cost Proposal*

Provide a proposed total fee outlining the proposal and identify the hourly fee schedule for all personnel to be involved in the project. The hourly rates should include fringe benefits, indirect costs and profit. The Consultant should also indicate what percentage of the scope of work is expected to be completed by each individual or pay classification included in fee proposal. Additionally, if applicable, a schedule of reimbursable expenses should be included.

*Response required

5.2 Other Required Responses

5.2.1 Business License Requirements

WHO NEEDS A BUSINESS LICENSE?

1. Is this vendor physically located in the City of Santa Monica?

Yes (Vendor must have a City of Santa Monica business license - contact the Business License unit for the appropriate forms. Skip question 2 & continue to “ADDITIONAL REQUIREMENTS” section below)

No (Continue to the next question)

2. Does this vendor physically come into the City of Santa Monica to conduct business and/or make deliveries?

Yes(Vendor must have a City of Santa Monica Out-of City Business License. contact the Business License unit for the appropriate forms. Continue to “ADDITIONAL REQUIREMENTS” section below)

No(STOP, no license needed)

ADDITIONAL REQUIREMENTS:

Cyber Security Managed Services

If this vendor is located in or comes into the City of Santa Monica to conduct business, in addition to having a CITY OF SANTA MONICA BUSINESS LICENSE, they will be required to have insurance (see agreement for descriptions).

The business license documentation is only required from the successful Proposer.

5.2.2 Notice Regarding Disclosure of Contents of Documents*

All responses to this Request for Proposal (RFP) accepted by the City of Santa Monica (City) shall become the exclusive property of the City. All proposals accepted by the City shall become a matter of public record and shall be regarded as public, with the exception of those elements of each proposal which are defined by the contractor as business or trade secrets and plainly marked as "Trade Secret", "Confidential" or "Proprietary". Each element of a proposal which a contractor desires not to be considered a public record must be clearly marked as set forth above, and any blanket statement (i.e. regarding entire pages, documents or other non-specific designations) shall not be sufficient and shall not bind the City in any way whatsoever. If disclosure is required or permitted under the California Public Records Act, or otherwise by law, the City shall not in any way be liable or responsible for the disclosure of any such records or part thereof.

☐ Please confirm

*Response required

5.2.3 Oaks Initiative*

CITY OF SANTA MONICA OAKS INITIATIVE NOTICE

NOTICE TO APPLICANTS, BIDDERS, PROPOSERS AND OTHERS SEEKING

DISCRETIONARY PERMITS, CONTRACTS, OR OTHER BENEFITS FROM THE CITY

OF SANTA MONICA

Santa Monica’s voters adopted a City Charter amendment commonly known as the Oaks Initiative. The Oaks Initiative requires the City to provide this notice and information about the Initiative’s requirements. You may obtain a full copy of the Initiative’s text from the City Clerk.

This information is required by City Charter Article XXII—Taxpayer Protection. It prohibits a public official from receiving, and a person or entity from conferring, specified personal benefits or campaign advantages from a person or entity after the official votes, or otherwise takes official action, to award a “public benefit” to that person or entity. The prohibition applies within and outside of the geographical boundaries of Santa Monica.

All persons or entities applying or receiving public benefits from the City of Santa Monica shall provide the names of trustees, directors, partners, and officers, and names of persons with more than a 10% equity, participation or revenue interest. An exception exists for persons serving in those capacities as volunteers, without compensation, for organizations exempt from income taxes under Section 501(c)(3), (4), or (6), of the Internal Revenue Code. However, this exception does not apply if the organization is a political committee or controls political committees. Examples of a “public benefit”

Cyber Security Managed Services include public contracts to provide goods or services worth more than $25,000 or a land use approval worth more than $25,000 over a 12-month period.

In order to facilitate compliance with the requirements of the Oaks Initiative, the City compiles and maintains certain information. That information includes the name of any person or persons who is seeking a “public benefit.” If the “public benefit” is sought by an entity, rather than an individual person, the information includes the name of every person who is: (a) trustee, (b) director, (c) partner, (d) officer, or has (e) more than a ten percent interest in the entity. Therefore, if you are seeking a “public benefit” covered by the Oaks Initiative, you must supply that information on the Oaks Initiative Disclosure Form. This information must be updated and supplied every 12 months.

• OAKS_INITIATIVE_FORM.pdf

• OAKS_INITIATIVE_FORM_-_Exam...

*Response required

5.2.4 Living Wage Ordinance Certification*

CITY OF SANTA MONICA LIVING WAGE ORDINANCE

Certification for Providers of Services to the City of Santa Monica (Fiscal Year 25/26 – July 1, 2025 through June 30, 2026)

TO BE COMPLETED BY ALL CONTRACTORS PROVIDING SERVICES TO THE CITY

OF SANTA MONICA IN EXCESS OF $54,200

The City of Santa Monica Municipal Code Chapter 4.65, Living Wage Ordinance (LWO), establishes a Minimum Wage of $21.01 for certain employees of contractors providing services to the City where services exceed $54,200 or more and requires that contractors also provide the same health care and other benefits to employees’ same sex spouses and domestic partners as are provided to other employees’ spouses.

An employee covered by the LWO is any person who does not actually work as a manager, supervisor, or confidential employee, and who is not required to possess an occupational license.

The Living Wage Ordinance applies the services sought pursuant to this bid and bidders are required to prepare and return the Living Wage Certification Form. If the bidder is selected, the bidder must maintain payroll records that include, at minimum, the full name of each employee providing services under the contract, job classification and rate of pay. Bids that fail to include Certification Forms may be considered non-responsive and excluded from further consideration.

Please prepare the following certification if you are a contractor engaging in a contract for services with the City of Santa Monica in excess of $54,200.

Your signature on this certification grants the City permission to review any and all payroll books and records and any company documents pertaining to the benefits offered to employees to assure your compliance with the LWO during the term of the contract.

Please direct any questions to:

https://government-project.s3.us-west-2.amazonaws.com/47043/abd14927-fc28-4c52-b1d3-483bf17bebad_OAKS_INITIATIVE_FORM.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=ASIA47RIURE4D3FZUDYD%2F20250922%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Date=20250922T170000Z&X-Amz-Expires=72000&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEKn%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLXdlc3QtMiJHMEUCIBkBJMq%2FNWmouiKT8VBhsbBHSVCAT1nL6I8EL27JgkCZAiEA1DlExBBquo57J0ZGJAI4qFkX3wjW461j58BNQLSauQMqigUIMhACGgw4OTIzNjQ2ODc2NzIiDG1Q%2B6jD%2FpwbLDg7gCrnBE%2B%2FERZEUSd5fPT5OPzhKqFxnBfyXy0DxSAd7wkAQIsJDNAxPSHtBqFEFdDnl95yHxKzIB%2F1%2BeIwRmFqse0YsRbQOBDFG%2F%2FE4guH9DDHnknRzXpIUHBQJ7HnGXhbkZ2hsl7kW%2FktvK%2FUPLXp5ywxOi15j6Cm07K1wonqbSYEVlnfWhTyeTkDSrCD5ZOQDH9huxAvz3McGfBpbaAfRz6ngn1Osw%2FkN2LY6%2FB5M6rn21l%2FFZQqd4ifl475b%2BL1qFGeIBzmzCQiDW7AuwYNOPWaPzpiGAK3qC0FrOmIDcqpQzaUhMZb8j2hFxsFIjrbjtmoX%2BQ9vxfPWiTyy2Lwp48IsikNxbwLT6N3LKy%2BACAo%2FC3shEYkJWBV5NxDlGVyRst76RAH1FeslkI6R975VhTHWxRQmK8ZTpLmnsmzh9czPKqO1ZJEL7oF2mUASof9x%2F5OCNDmEjSxeY8tdTPRXOq0gfFWqATobVpkjFwQ1cHGftWudP5VycAFQdtMhjSKQf99AYU0RZ2WuHTYAU0so3iawMNuqZ9QylxYKzSTp5uKcjDYjBRNQOCL2Iq2zBvMO5Beo%2BJRwxCY%2B6ofjh3Sq3sufmL%2FF0vAPlIP2sn%2BClBArBm6D7uLxEG%2BlmWTREx82jzKLhKd%2FisOisMfOZzIPB72y2YWeDIds%2FMbPcJ1ONwvS2N3NB4LkD1BUDROC%2BUDb6CXQrTWvGq9Kuws8pDweviDM4C6mkpLbrnU%2FKIrboFRtl2zuR9vF2FWioKVJeY%2FBrXqcddU11FZJ5FOTbzwId%2BfqX6h6KKLdnfT5iVqv5ZcqiutJxxy99MEejC8%2FMXGBjqbAf%2FEI%2BTORrqXuhnH9qyL21RitHO2UX9hpXvhuMiV6BLEMoHxaE7qazpouu8AWuh%2FCEyqPYKkspN9YlooCainVeBZ%2BWq86uSxDh9aNcdqKhYKLDnXmh1ZoKO8ibdTO%2FNOnmDFFdJfQjx7mfCEVUF4QeTgKiKsdBiPdlkxinlfXpkuRA5Vj88HYFxsYYsv0a%2BJgFqj6MOAR4EmVExN&X-Amz-Signature=6319717c0c7520f6994ec69cf136a5744a688e13502dc3a7ada875c282249a39&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3D%22OAKS_INITIATIVE_FORM.pdf%22&x-id=GetObject https://government-project.s3.us-west-2.amazonaws.com/47043/3200d340-ceaf-43f6-8fdb-0244a0434690_OAKS_INITIATIVE_FORM_-_Example_revised_06.07.23.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=ASIA47RIURE4D3FZUDYD%2F20250922%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Date=20250922T170000Z&X-Amz-Expires=72000&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEKn%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLXdlc3QtMiJHMEUCIBkBJMq%2FNWmouiKT8VBhsbBHSVCAT1nL6I8EL27JgkCZAiEA1DlExBBquo57J0ZGJAI4qFkX3wjW461j58BNQLSauQMqigUIMhACGgw4OTIzNjQ2ODc2NzIiDG1Q%2B6jD%2FpwbLDg7gCrnBE%2B%2FERZEUSd5fPT5OPzhKqFxnBfyXy0DxSAd7wkAQIsJDNAxPSHtBqFEFdDnl95yHxKzIB%2F1%2BeIwRmFqse0YsRbQOBDFG%2F%2FE4guH9DDHnknRzXpIUHBQJ7HnGXhbkZ2hsl7kW%2FktvK%2FUPLXp5ywxOi15j6Cm07K1wonqbSYEVlnfWhTyeTkDSrCD5ZOQDH9huxAvz3McGfBpbaAfRz6ngn1Osw%2FkN2LY6%2FB5M6rn21l%2FFZQqd4ifl475b%2BL1qFGeIBzmzCQiDW7AuwYNOPWaPzpiGAK3qC0FrOmIDcqpQzaUhMZb8j2hFxsFIjrbjtmoX%2BQ9vxfPWiTyy2Lwp48IsikNxbwLT6N3LKy%2BACAo%2FC3shEYkJWBV5NxDlGVyRst76RAH1FeslkI6R975VhTHWxRQmK8ZTpLmnsmzh9czPKqO1ZJEL7oF2mUASof9x%2F5OCNDmEjSxeY8tdTPRXOq0gfFWqATobVpkjFwQ1cHGftWudP5VycAFQdtMhjSKQf99AYU0RZ2WuHTYAU0so3iawMNuqZ9QylxYKzSTp5uKcjDYjBRNQOCL2Iq2zBvMO5Beo%2BJRwxCY%2B6ofjh3Sq3sufmL%2FF0vAPlIP2sn%2BClBArBm6D7uLxEG%2BlmWTREx82jzKLhKd%2FisOisMfOZzIPB72y2YWeDIds%2FMbPcJ1ONwvS2N3NB4LkD1BUDROC%2BUDb6CXQrTWvGq9Kuws8pDweviDM4C6mkpLbrnU%2FKIrboFRtl2zuR9vF2FWioKVJeY%2FBrXqcddU11FZJ5FOTbzwId%2BfqX6h6KKLdnfT5iVqv5ZcqiutJxxy99MEejC8%2FMXGBjqbAf%2FEI%2BTORrqXuhnH9qyL21RitHO2UX9hpXvhuMiV6BLEMoHxaE7qazpouu8AWuh%2FCEyqPYKkspN9YlooCainVeBZ%2BWq86uSxDh9aNcdqKhYKLDnXmh1ZoKO8ibdTO%2FNOnmDFFdJfQjx7mfCEVUF4QeTgKiKsdBiPdlkxinlfXpkuRA5Vj88HYFxsYYsv0a%2BJgFqj6MOAR4EmVExN&X-Amz-Signature=5dbc81c97d6bee0387a4c7affab1489333d2ec6cb3aebdf07cd01ce82d9482f4&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3D%22OAKS_INITIATIVE_FORM_-_Example_revised_06.07.23.pdf%22&x-id=GetObject

Cyber Security Managed Services

City of Santa Monica Finance Department Attention: Living Wage Compliance Section 1685 Main Street, Mail Stop 09 Santa Monica, CA 90401

You can also contact staff regarding living wage ordinance questions by e-mail at finance.mailbox@smgov.net or by phone 310-458-8281.

• FY25-26_Living_Wage_Certifi...

*Response required

5.2.5 Certificate of Compliance*

Please upload your completed Certificate of Compliance document here.

• Certification_of_Compliance...

*Response required

5.2.6 Non-Discrimination Policy, Debarment Certification & Non- Collusion Declaration*

Please download the below documents, complete, and upload.

• Proposal_Forms_(10).pdf

*Response required

5.2.7 Levine Act Disclosure Form*

Please download the below documents, complete, and upload.

• Levine_Act_Disclosure_Form.pdf

• Disclosure_Form_cover_memo.pdf

*Response required

6 Evaluation Criteria

1. The evaluation procedure will be a two (2) phase process.

a) The first phase will identify proposals technically qualified to perform the work.

Price proposals will be opened only from the proposals that are deemed technically qualified (short-listed) to perform the work.

b) The second phase will select the three (3) highest ranking proposals from those short-listed proposals following an additional evaluation which may include, but not limited to: on-site interviews, demonstration testing, and evaluation of performance.

c) The same evaluation criteria shall be used for each phase; however scoring is not cumulative from the first phase to the second (i.e., an independent score will https://government-project.s3.us-west-2.amazonaws.com/185531/af3bdbb4-d6e4-49e1-be49-eb63f5e08498_FY25-26_Living_Wage_Certification_Fillable_%2421.01.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=ASIA47RIURE4D3FZUDYD%2F20250922%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Date=20250922T170000Z&X-Amz-Expires=72000&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEKn%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLXdlc3QtMiJHMEUCIBkBJMq%2FNWmouiKT8VBhsbBHSVCAT1nL6I8EL27JgkCZAiEA1DlExBBquo57J0ZGJAI4qFkX3wjW461j58BNQLSauQMqigUIMhACGgw4OTIzNjQ2ODc2NzIiDG1Q%2B6jD%2FpwbLDg7gCrnBE%2B%2FERZEUSd5fPT5OPzhKqFxnBfyXy0DxSAd7wkAQIsJDNAxPSHtBqFEFdDnl95yHxKzIB%2F1%2BeIwRmFqse0YsRbQOBDFG%2F%2FE4guH9DDHnknRzXpIUHBQJ7HnGXhbkZ2hsl7kW%2FktvK%2FUPLXp5ywxOi15j6Cm07K1wonqbSYEVlnfWhTyeTkDSrCD5ZOQDH9huxAvz3McGfBpbaAfRz6ngn1Osw%2FkN2LY6%2FB5M6rn21l%2FFZQqd4ifl475b%2BL1qFGeIBzmzCQiDW7AuwYNOPWaPzpiGAK3qC0FrOmIDcqpQzaUhMZb8j2hFxsFIjrbjtmoX%2BQ9vxfPWiTyy2Lwp48IsikNxbwLT6N3LKy%2BACAo%2FC3shEYkJWBV5NxDlGVyRst76RAH1FeslkI6R975VhTHWxRQmK8ZTpLmnsmzh9czPKqO1ZJEL7oF2mUASof9x%2F5OCNDmEjSxeY8tdTPRXOq0gfFWqATobVpkjFwQ1cHGftWudP5VycAFQdtMhjSKQf99AYU0RZ2WuHTYAU0so3iawMNuqZ9QylxYKzSTp5uKcjDYjBRNQOCL2Iq2zBvMO5Beo%2BJRwxCY%2B6ofjh3Sq3sufmL%2FF0vAPlIP2sn%2BClBArBm6D7uLxEG%2BlmWTREx82jzKLhKd%2FisOisMfOZzIPB72y2YWeDIds%2FMbPcJ1ONwvS2N3NB4LkD1BUDROC%2BUDb6CXQrTWvGq9Kuws8pDweviDM4C6mkpLbrnU%2FKIrboFRtl2zuR9vF2FWioKVJeY%2FBrXqcddU11FZJ5FOTbzwId%2BfqX6h6KKLdnfT5iVqv5ZcqiutJxxy99MEejC8%2FMXGBjqbAf%2FEI%2BTORrqXuhnH9qyL21RitHO2UX9hpXvhuMiV6BLEMoHxaE7qazpouu8AWuh%2FCEyqPYKkspN9YlooCainVeBZ%2BWq86uSxDh9aNcdqKhYKLDnXmh1ZoKO8ibdTO%2FNOnmDFFdJfQjx7mfCEVUF4QeTgKiKsdBiPdlkxinlfXpkuRA5Vj88HYFxsYYsv0a%2BJgFqj6MOAR4EmVExN&X-Amz-Signature=040cd2685eae652eb9b9704ccae8f96c29a0362d4cf550958bfd1dac6b6b18ae&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3D%22FY25-26_Living_Wage_Certification_Fillable_%252421.01.pdf%22&x-id=GetObject https://government-project.s3.us-west-2.amazonaws.com/47043/294f31b8-a812-425c-9a19-649387ed2d22_Certification_of_Compliance_Form.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=ASIA47RIURE4D3FZUDYD%2F20250922%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Date=20250922T170000Z&X-Amz-Expires=72000&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEKn%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLXdlc3QtMiJHMEUCIBkBJMq%2FNWmouiKT8VBhsbBHSVCAT1nL6I8EL27JgkCZAiEA1DlExBBquo57J0ZGJAI4qFkX3wjW461j58BNQLSauQMqigUIMhACGgw4OTIzNjQ2ODc2NzIiDG1Q%2B6jD%2FpwbLDg7gCrnBE%2B%2FERZEUSd5fPT5OPzhKqFxnBfyXy0DxSAd7wkAQIsJDNAxPSHtBqFEFdDnl95yHxKzIB%2F1%2BeIwRmFqse0YsRbQOBDFG%2F%2FE4guH9DDHnknRzXpIUHBQJ7HnGXhbkZ2hsl7kW%2FktvK%2FUPLXp5ywxOi15j6Cm07K1wonqbSYEVlnfWhTyeTkDSrCD5ZOQDH9huxAvz3McGfBpbaAfRz6ngn1Osw%2FkN2LY6%2FB5M6rn21l%2FFZQqd4ifl475b%2BL1qFGeIBzmzCQiDW7AuwYNOPWaPzpiGAK3qC0FrOmIDcqpQzaUhMZb8j2hFxsFIjrbjtmoX%2BQ9vxfPWiTyy2Lwp48IsikNxbwLT6N3LKy%2BACAo%2FC3shEYkJWBV5NxDlGVyRst76RAH1FeslkI6R975VhTHWxRQmK8ZTpLmnsmzh9czPKqO1ZJEL7oF2mUASof9x%2F5OCNDmEjSxeY8tdTPRXOq0gfFWqATobVpkjFwQ1cHGftWudP5VycAFQdtMhjSKQf99AYU0RZ2WuHTYAU0so3iawMNuqZ9QylxYKzSTp5uKcjDYjBRNQOCL2Iq2zBvMO5Beo%2BJRwxCY%2B6ofjh3Sq3sufmL%2FF0vAPlIP2sn%2BClBArBm6D7uLxEG%2BlmWTREx82jzKLhKd%2FisOisMfOZzIPB72y2YWeDIds%2FMbPcJ1ONwvS2N3NB4LkD1BUDROC%2BUDb6CXQrTWvGq9Kuws8pDweviDM4C6mkpLbrnU%2FKIrboFRtl2zuR9vF2FWioKVJeY%2FBrXqcddU11FZJ5FOTbzwId%2BfqX6h6KKLdnfT5iVqv5ZcqiutJxxy99MEejC8%2FMXGBjqbAf%2FEI%2BTORrqXuhnH9qyL21RitHO2UX9hpXvhuMiV6BLEMoHxaE7qazpouu8AWuh%2FCEyqPYKkspN9YlooCainVeBZ%2BWq86uSxDh9aNcdqKhYKLDnXmh1ZoKO8ibdTO%2FNOnmDFFdJfQjx7mfCEVUF4QeTgKiKsdBiPdlkxinlfXpkuRA5Vj88HYFxsYYsv0a%2BJgFqj6MOAR4EmVExN&X-Amz-Signature=b54f0b12b48fea6102027bf59074813cb2860541abaa3e895022a38e33f348c0&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3D%22Certification_of_Compliance_Form.pdf%22&x-id=GetObject https://government-project.s3.us-west-2.amazonaws.com/47043/38578718-f7ba-4c5d-ad88-08ae33fdd4f7_Proposal_Forms_%2810%29.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=ASIA47RIURE4D3FZUDYD%2F20250922%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Date=20250922T170000Z&X-Amz-Expires=72000&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEKn%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLXdlc3QtMiJHMEUCIBkBJMq%2FNWmouiKT8VBhsbBHSVCAT1nL6I8EL27JgkCZAiEA1DlExBBquo57J0ZGJAI4qFkX3wjW461j58BNQLSauQMqigUIMhACGgw4OTIzNjQ2ODc2NzIiDG1Q%2B6jD%2FpwbLDg7gCrnBE%2B%2FERZEUSd5fPT5OPzhKqFxnBfyXy0DxSAd7wkAQIsJDNAxPSHtBqFEFdDnl95yHxKzIB%2F1%2BeIwRmFqse0YsRbQOBDFG%2F%2FE4guH9DDHnknRzXpIUHBQJ7HnGXhbkZ2hsl7kW%2FktvK%2FUPLXp5ywxOi15j6Cm07K1wonqbSYEVlnfWhTyeTkDSrCD5ZOQDH9huxAvz3McGfBpbaAfRz6ngn1Osw%2FkN2LY6%2FB5M6rn21l%2FFZQqd4ifl475b%2BL1qFGeIBzmzCQiDW7AuwYNOPWaPzpiGAK3qC0FrOmIDcqpQzaUhMZb8j2hFxsFIjrbjtmoX%2BQ9vxfPWiTyy2Lwp48IsikNxbwLT6N3LKy%2BACAo%2FC3shEYkJWBV5NxDlGVyRst76RAH1FeslkI6R975VhTHWxRQmK8ZTpLmnsmzh9czPKqO1ZJEL7oF2mUASof9x%2F5OCNDmEjSxeY8tdTPRXOq0gfFWqATobVpkjFwQ1cHGftWudP5VycAFQdtMhjSKQf99AYU0RZ2WuHTYAU0so3iawMNuqZ9QylxYKzSTp5uKcjDYjBRNQOCL2Iq2zBvMO5Beo%2BJRwxCY%2B6ofjh3Sq3sufmL%2FF0vAPlIP2sn%2BClBArBm6D7uLxEG%2BlmWTREx82jzKLhKd%2FisOisMfOZzIPB72y2YWeDIds%2FMbPcJ1ONwvS2N3NB4LkD1BUDROC%2BUDb6CXQrTWvGq9Kuws8pDweviDM4C6mkpLbrnU%2FKIrboFRtl2zuR9vF2FWioKVJeY%2FBrXqcddU11FZJ5FOTbzwId%2BfqX6h6KKLdnfT5iVqv5ZcqiutJxxy99MEejC8%2FMXGBjqbAf%2FEI%2BTORrqXuhnH9qyL21RitHO2UX9hpXvhuMiV6BLEMoHxaE7qazpouu8AWuh%2FCEyqPYKkspN9YlooCainVeBZ%2BWq86uSxDh9aNcdqKhYKLDnXmh1ZoKO8ibdTO%2FNOnmDFFdJfQjx7mfCEVUF4QeTgKiKsdBiPdlkxinlfXpkuRA5Vj88HYFxsYYsv0a%2BJgFqj6MOAR4EmVExN&X-Amz-Signature=4ab35caae318cd018988673adbd17d9883907de0c6e0c97021a11416e463c65a&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3D%22Proposal_Forms_%2810%29.pdf%22&x-id=GetObject https://government-project.s3.us-west-2.amazonaws.com/47043/029e03b7-b15f-489c-aca1-50a376b035d1_Levine_Act_Disclosure_Form.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=ASIA47RIURE4D3FZUDYD%2F20250922%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Date=20250922T170000Z&X-Amz-Expires=72000&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEKn%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLXdlc3QtMiJHMEUCIBkBJMq%2FNWmouiKT8VBhsbBHSVCAT1nL6I8EL27JgkCZAiEA1DlExBBquo57J0ZGJAI4qFkX3wjW461j58BNQLSauQMqigUIMhACGgw4OTIzNjQ2ODc2NzIiDG1Q%2B6jD%2FpwbLDg7gCrnBE%2B%2FERZEUSd5fPT5OPzhKqFxnBfyXy0DxSAd7wkAQIsJDNAxPSHtBqFEFdDnl95yHxKzIB%2F1%2BeIwRmFqse0YsRbQOBDFG%2F%2FE4guH9DDHnknRzXpIUHBQJ7HnGXhbkZ2hsl7kW%2FktvK%2FUPLXp5ywxOi15j6Cm07K1wonqbSYEVlnfWhTyeTkDSrCD5ZOQDH9huxAvz3McGfBpbaAfRz6ngn1Osw%2FkN2LY6%2FB5M6rn21l%2FFZQqd4ifl475b%2BL1qFGeIBzmzCQiDW7AuwYNOPWaPzpiGAK3qC0FrOmIDcqpQzaUhMZb8j2hFxsFIjrbjtmoX%2BQ9vxfPWiTyy2Lwp48IsikNxbwLT6N3LKy%2BACAo%2FC3shEYkJWBV5NxDlGVyRst76RAH1FeslkI6R975VhTHWxRQmK8ZTpLmnsmzh9czPKqO1ZJEL7oF2mUASof9x%2F5OCNDmEjSxeY8tdTPRXOq0gfFWqATobVpkjFwQ1cHGftWudP5VycAFQdtMhjSKQf99AYU0RZ2WuHTYAU0so3iawMNuqZ9QylxYKzSTp5uKcjDYjBRNQOCL2Iq2zBvMO5Beo%2BJRwxCY%2B6ofjh3Sq3sufmL%2FF0vAPlIP2sn%2BClBArBm6D7uLxEG%2BlmWTREx82jzKLhKd%2FisOisMfOZzIPB72y2YWeDIds%2FMbPcJ1ONwvS2N3NB4LkD1BUDROC%2BUDb6CXQrTWvGq9Kuws8pDweviDM4C6mkpLbrnU%2FKIrboFRtl2zuR9vF2FWioKVJeY%2FBrXqcddU11FZJ5FOTbzwId%2BfqX6h6KKLdnfT5iVqv5ZcqiutJxxy99MEejC8%2FMXGBjqbAf%2FEI%2BTORrqXuhnH9qyL21RitHO2UX9hpXvhuMiV6BLEMoHxaE7qazpouu8AWuh%2FCEyqPYKkspN9YlooCainVeBZ%2BWq86uSxDh9aNcdqKhYKLDnXmh1ZoKO8ibdTO%2FNOnmDFFdJfQjx7mfCEVUF4QeTgKiKsdBiPdlkxinlfXpkuRA5Vj88HYFxsYYsv0a%2BJgFqj6MOAR4EmVExN&X-Amz-Signature=ff359a7a6d787bca1a7bdc928a891ae394d131778ca0d6a93af7f34d3a3a9801&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3D%22Levine_Act_Disclosure_Form.pdf%22&x-id=GetObject https://government-project.s3.us-west-2.amazonaws.com/47043/011dc5e8-6371-4db8-8334-010963a2a81f_Disclosure_Form_cover_memo.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=ASIA47RIURE4D3FZUDYD%2F20250922%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Date=20250922T170000Z&X-Amz-Expires=72000&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEKn%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLXdlc3QtMiJHMEUCIBkBJMq%2FNWmouiKT8VBhsbBHSVCAT1nL6I8EL27JgkCZAiEA1DlExBBquo57J0ZGJAI4qFkX3wjW461j58BNQLSauQMqigUIMhACGgw4OTIzNjQ2ODc2NzIiDG1Q%2B6jD%2FpwbLDg7gCrnBE%2B%2FERZEUSd5fPT5OPzhKqFxnBfyXy0DxSAd7wkAQIsJDNAxPSHtBqFEFdDnl95yHxKzIB%2F1%2BeIwRmFqse0YsRbQOBDFG%2F%2FE4guH9DDHnknRzXpIUHBQJ7HnGXhbkZ2hsl7kW%2FktvK%2FUPLXp5ywxOi15j6Cm07K1wonqbSYEVlnfWhTyeTkDSrCD5ZOQDH9huxAvz3McGfBpbaAfRz6ngn1Osw%2FkN2LY6%2FB5M6rn21l%2FFZQqd4ifl475b%2BL1qFGeIBzmzCQiDW7AuwYNOPWaPzpiGAK3qC0FrOmIDcqpQzaUhMZb8j2hFxsFIjrbjtmoX%2BQ9vxfPWiTyy2Lwp48IsikNxbwLT6N3LKy%2BACAo%2FC3shEYkJWBV5NxDlGVyRst76RAH1FeslkI6R975VhTHWxRQmK8ZTpLmnsmzh9czPKqO1ZJEL7oF2mUASof9x%2F5OCNDmEjSxeY8tdTPRXOq0gfFWqATobVpkjFwQ1cHGftWudP5VycAFQdtMhjSKQf99AYU0RZ2WuHTYAU0so3iawMNuqZ9QylxYKzSTp5uKcjDYjBRNQOCL2Iq2zBvMO5Beo%2BJRwxCY%2B6ofjh3Sq3sufmL%2FF0vAPlIP2sn%2BClBArBm6D7uLxEG%2BlmWTREx82jzKLhKd%2FisOisMfOZzIPB72y2YWeDIds%2FMbPcJ1ONwvS2N3NB4LkD1BUDROC%2BUDb6CXQrTWvGq9Kuws8pDweviDM4C6mkpLbrnU%2FKIrboFRtl2zuR9vF2FWioKVJeY%2FBrXqcddU11FZJ5FOTbzwId%2BfqX6h6KKLdnfT5iVqv5ZcqiutJxxy99MEejC8%2FMXGBjqbAf%2FEI%2BTORrqXuhnH9qyL21RitHO2UX9hpXvhuMiV6BLEMoHxaE7qazpouu8AWuh%2FCEyqPYKkspN9YlooCainVeBZ%2BWq86uSxDh9aNcdqKhYKLDnXmh1ZoKO8ibdTO%2FNOnmDFFdJfQjx7mfCEVUF4QeTgKiKsdBiPdlkxinlfXpkuRA5Vj88HYFxsYYsv0a%2BJgFqj6MOAR4EmVExN&X-Amz-Signature=46d190e6b3e22bf1597ef414e1919845a23ed7198d85bae5307f75c2d57ad399&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3D%22Disclosure_Form_cover_memo.pdf%22&x-id=GetObject

Cyber Security Managed Services be developed in the second phase for Proposers using the same evaluation criteria).

d) Proposers are responsible for all travel expenses incurred.

No. Evaluation Criteria Scoring Method Weight (Points)

1. Quality Control Up to 10 points may be awarded based on the proposer’s approach to ensuring quality assurance and adherence to cybersecurity standards. Evaluation will consider the proposer’s methodology for penetration testing, risk assessments, and incident response exercises, as well as demonstrated compliance with industry-standard security frameworks such as NIST CSF, CIS Controls, and ISO 27001.

Points Based 10 (10% of Total)

2. Stability / References Up to 10 points may be awarded upon an evaluation of proposer’s work for similar engagements.

Points Based 15 (15% of Total)

3. Value Add / Breadth of Service Up to 10 points may be awarded based on the proposer’s ability to provide additional security services beyond the core scope of work. Evaluation will consider the ability to offer optional cybersecurity services such as phishing simulations, cybersecurity training, web application penetration testing, and grant management. The proposer’s approach to threat intelligence sharing, executive security briefings, and employee cybersecurity awareness programs will also be reviewed, along with the firm’s ability to provide ongoing advisory services and support beyond the contracted engagement.

Points Based 10 (10% of Total)

4. Cost Up to 20 points may be awarded based on the proposer’s overall cost proposal, ensuring cost-effective service delivery while maintaining quality. Evaluation will consider the proposed pricing model, whether fixed, blended hourly rate, or annual not-to-exceed fee, and its alignment with the scope of work. Consideration will also be given to the proposer’s demonstrated ability to provide cost-effective cybersecurity services while maintaining industry best practices, as well as the proposer’s approach to cost control, budgeting, and resource allocation. The proposer should provide descriptions of previous engagements demonstrating the ability to deliver services within budget constraints.

Points Based 20 (20% of Total)

Cyber Security Managed Services

5. Experience / Technical Competence Up to 20 points may be awarded based on the proposer’s knowledge, expertise, and prior experience in cybersecurity managed services. Evaluation will consider the relevant experience of key personnel, including industry-recognized cybersecurity certifications such as CEH, OSCP, and CISSP. The proposer’s previous projects of comparable complexity, scale, and nature, particularly for municipal governments or public entities, will also be evaluated.

Consideration will be given to demonstrated experience in penetration testing, vulnerability management, risk assessments, and incident response, as well as the proposer’s work plan, including methodologies for executing cybersecurity assessments and ongoing security management.

Points Based 25 (25% of Total)

6. Ability to Meet Work Plan / Timelines Up to 20 points may be awarded based on the proposer’s ability to meet project deadlines and efficiently execute the required services. Evaluation will consider the proposer’s staffing capacity and ability to deploy a qualified cybersecurity team, assurance of resources to accommodate project changes or turnover in personnel, and the proposer’s track record of completing cybersecurity assessments, penetration tests, and remediation reports on schedule. Demonstrated ability to meet reporting deadlines in previous engagements will also be taken into account.

Points Based 20 (20% of Total)

7 Award Process

7.1 Selection

The City of Santa Monica, through either the City Council or the City Manager (or his designee) has the sole authority to select the consulting firm and reserves the right to reject any and all proposals. The City reserves the right to approve or reject all sub-consultants and engineers proposed to be retained by the prime consultant. Upon signing of the agreement, no change in proposed personnel or sub-consultants can be made without the City’s review and written authorization.

By submitting a response to this RFP, prospective consultants waive the right to protest after award or seek any legal remedies whatsoever regarding any aspect of this RFP.

The City reserves the right to select any number of finalists. In addition, the City reserves the right to issue written notice to all prospective consultants of any changes in

Cyber Security Managed Services the RFP terms or proposal submission schedule, should the City determine in its sole and absolute discretion that such changes are necessary.

The City reserves the right to request additional information from any proposing consultant and to reject any and all proposals. All original work products, including computer files, shall remain the property of the City.

The City reserves the right to retain an expert to evaluate the proposing consultant’s work or qualifications at all stages in the selection process. Additionally, any contract entered into will be subject to termination at any stage if in the judgment of the City, such termination is in the best interest of the City. In the event such decision is made, appropriate written notice would be given before any termination and the consultant would be compensated on a pro-rata basis for work performed.

The responsible proposer whose proposal is the most advantageous to the City, taking to consideration all the evaluation factors will be recommended for the contract award.

Notwithstanding the Evaluation Team’s selection, the City reserves the right to award this RFP and the resultant Contract in any manner it deems to be in the best interest of the City and make the selection based on its sole discretion. The City is the sole and exclusive judge of quality and compliance with proposal specifications in any of the matters pertaining to this RFP.

7.2 Contract Award and Execution

Selection of a proposer with whom the City enters into contract negotiations with, or a recommendation of an award by the Evaluation Committee or any other party, does not constitute an award of Contract. Once the City formally awards the contract, the successful consultant will be notified to enter into an agreement. If the selected consultant does not enter into the agreement, the City will begin negotiations with the second highest ranking proposing consultant.

Please review all contract forms prior to submitting a proposal. The City of Santa Monica intends to use these forms as the baseline agreements with the successful consultant. The City will not entertain proposals to make material changes to the contract form once the project has been awarded. If you wish to request changes to the contracting forms, you must do so during the proposal process. In addition, the City requires compliance with several other policies and ordinances, proposing consultants will need to complete these Exhibits and submit with their Proposal.

The RFP document and the successful proposal response, as amended by agreement between the City of Santa Monica and the successful consultant, will become part of the contract documents. Additionally, the City of Santa Monica may verify the successful consultant’s representations that appear in the proposal. Failure of the successful consultant to perform as represented may result in elimination of the successful consultant from further negotiation or in contract cancellation or termination.

No oral explanation or instruction of any kind or nature whatsoever given before the award of a contract to a consultant shall be binding. The City of Santa Monica shall not be bound, or in any way obligated, until the City has awarded the contract and all

Cyber Security Managed Services documents have been executed. The proposing consultant may not incur any chargeable costs prior to final contract execution.

8 Terms & Conditions

8.1 Best Qualified Person Or Firm

The award, if any, will be made to the best qualified person or firm(s). In evaluating whether a proposer(s) is (are) the best qualified person or firm(s) pursuant to the Santa Monica Municipal Code, City staff may utilize some or all of the following criteria:

A. The training, credentials and experience of the person or firm;

B. The demonstrated competence, ability, capacity and skill of the person or firm to perform the contract or provide the services;

C. The capacity of the person or firm to perform the contract or provide the service promptly, within the time specified, and without delay;

D. The sufficiency of the person’s or firm’s financial and other resources;

E. The character, integrity, reputation and judgment of the person or firm;

F. The ability of the person or firm to provide such future service as may be needed;

G. The price which the person or firm proposes to charge, including whether the price is fair, reasonable and competitive; and

H. Any other factor which will further the intent set forth in Section 608 of the City Charter.

The City shall have absolute discretion in determining the applicability and weight or relative weight of some or all of the criteria listed above and is not required to select the lowest monetary proposer.

8.2 Receiving Time / Late Proposals

It is the responsibility of proposer to see that their proposal is submitted with sufficient time to be received by the City prior to the proposal closing time. The receiving time in the City Office will be the governing time for acceptability of proposals.

Late proposals are not accepted.

8.3 Acceptance of Conditions Governing this RFP

Submission of a proposal constitutes acceptance of the Evaluation Factors contained in this RFP.

Cyber Security Managed Services

8.4 Incurring Cost

Any cost incurred by the proposer in preparation, transmittal, presentation of any proposal or material submitted in response to this RFP shall be borne solely by the proposer.

8.5 Prime Consultant Responsibility

Any agreement that may result from the RFP shall specify that the prime consultant is solely responsible for fulfillment of the agreement with the City. The City will make agreement payments only to the prime consultant.

8.6 Sub-consultants

Use of sub-consultants must be clearly explained in the proposal, and major sub-consultants must be identified by name. Prime consultants shall be wholly responsible for the entire performance whether or not sub-consultants are used.

8.7 Amended Proposals

A proposer may submit an amended proposal before the deadline for receipt of proposals. Such amended proposals must be complete replacements for a previously submitted proposal and must be clearly identified as such in the transmittal letter. City personnel will not merge, collate, or assemble proposal materials.

8.8 Proposer’s Rights to Withdraw Proposal

Proposers will be allowed to withdraw their proposals at any time prior to the deadline for receipt of proposals. The proposer must submit a written withdrawal request signed by the proposer’s duly authorized representative addressed to the City Contact.

8.9 Proposal Offer Firm

Responses to this RFP, including proposal prices, will be considered firm for one hundred eighty (180) days after the due date for receipt of proposals or sixty (60) days after receipt of a best and final offer, if one is requested.

8.10 Best and Final Offer

The City reserves the right to request Best and Final Offers from any or all proposers.

This will be the only opportunity to amend or modify proposals based on feedback from the City. Information from competing proposals will not be disclosed to other proposers prior to submission of a Best and Final Offer.

Cyber Security Managed Services

8.11 Living Wage Requirement

Any agreement issued as a result of this Request for Proposal may be subject to the City’s Living Wage Ordinance, Santa Monica Municipal Code Chapter 4.65 (LWO), and its implementing regulations.

8.12 Disclosure of Proposal Contents

All proposals are subject to the provisions of the California Public Records Act, California Government Code section 6250 et seq., and any information submitted with a response is a public record subject to disclosure, unless a specific exemption applies.

8.13 Notice Regarding Disclosure of Contents of Documents

All responses to this Request for Proposal (RFP) accepted by the City of Santa Monica (City) shall become the exclusive property of the City. All proposals accepted by the City shall become a matter of public record and shall be regarded as public, with the exception of those elements of each proposal which are defined by the contractor as business or trade secrets and plainly marked as "Trade Secret", "Confidential" or "Proprietary". Each element of a proposal which a contractor desires not to be considered a public record must be clearly marked as set forth above, and any blanket statement (i.e.