Cybersecurity Assessment (RFP IT 26_10) Packe.pdf

City of Norcross

Information Technology Department

REQUEST FOR PROPOSALS

CYBERSECURITY ASSESSMENT, COMPLIANCE,

& GOVERNANCE SERVICES

RFP 26-10

City of Norcross Information Technology Department

REQUEST FOR PROPOSALS

CYBERSECURITY ASSESSMENT, COMPLIANCE, & GOVERNANCE

SERVICES

RFP IT 26-10

The City of Norcross Information Technology Department is seeking competitive proposals from qualified cybersecurity consulting firms to assess our current security posture, develop a comprehensive security and compliance framework, and deliver tailored training to our personnel. The ideal partner will help us establish a sustainable, self-sufficient cybersecurity governance structure.

The proposal package should be clearly marked “RFP IT 26-10– CYBERSECURITY ASSESSMENT, COMPLIANCE, & GOVERNANCE SERVICES” on its face and submitted by 10:00 a.m. (EST) on July 7, 2026, to the address below. Please submit two printed copies and one electronic copy (USB) of your RFP package to:

Charlene Marsh Procurement & Capital Projects Manager

City of Norcross Public Works Department 345 Lively Avenue

Norcross, GA 30071

Both printed and electronic copies must contain the same information. Return address must be clearly marked on the outside of the proposal packet.

There will be an optional pre-proposal meeting for this solicitation on June 26, 2026, at 10:00 a.m. at Norcross City Hall (65 Lawrenceville Street Norcross, GA 30071).

Please submit questions/requests via e-mail only to procurement@norcrossga.net by 5:00 p.m. (EST) on June 29, 2026. Questions and answers will be posted in an addendum on the City Website.

No proposal will be received or accepted after the above specified date and time.

Submissions received after the designated date and time will be deemed invalid and returned unopened to the firm.

No proposal may be withdrawn within thirty (30) days after the proposal deadline. Requests for withdrawals must be submitted in writing. All proposals shall remain firm for 90 days after the submission deadline.

mailto:procurement@norcrossga.net https://www.norcrossga.net/bids.aspx

1. INTRODUCTION

The City of Norcross is seeking competitive proposals from qualified cybersecurity consulting firms to assess our current security posture, develop a comprehensive security and compliance framework, and deliver tailored training to our personnel. The ideal partner will help us establish a sustainable, self-sufficient cybersecurity governance structure. The project will ultimately result in the development of federally compliant cybersecurity policy infrastructure designed for the City of Norcross cybersecurity goals. Consultants’ proposals with verifiable grant-funded security projects and experience in conjunction with NIST-aligned frameworks in local municipalities will be given strong consideration. The selected consultant must align itself with Georgia’s state cybersecurity plan, coordinated with the Georgia Technology Authority (GTA) and State and Local Cybersecurity Grant Program (SLCGP) Objective 1.

2. BACKGROUND

The City of Norcross is home to over 19,000 residents. The city currently employs approximately 150 full-time and part-time employees across 12 departments, including E-911 Dispatch and Norcross Police. Norcross Power, the city’s utility company, provides power to approximately 5,500 residential and commercial customers. The City of Norcross Information Technology Department and Main Distribution Frame (MDF) are housed in City Hall, connecting the multiple city buildings along with our co-location via a distributed WAN environment.

3. PROJECT DESCRIPTION

This project will ultimately result in the development of federally compliant cybersecurity policy infrastructure designed for the City of Norcross cybersecurity goals.

Consultants’ proposals with verifiable grant-funded security projects and experience in conjunction with NIST-aligned frameworks in local municipalities will be given strong consideration.

The selected consultant must align itself with Georgia’s state cybersecurity plan, coordinated with the Georgia Technology Authority (GTA) and State and Local Cybersecurity Grant Program (SLCGP) Objective 1.

The proposal must align the City of Norcross with the governance standardization that incorporates CIS 18 Critical Controls and the NIST Risk Management and Cybersecurity Frameworks.

The selected consultant must also perform the following tasks:

• Conduct a cybersecurity risk assessment across all City of Norcross departments.

• Develop a comprehensive cybersecurity plan in the identification, protection, detection, response and recovery of data.

• Present a cybersecurity resiliency roadmap with incorporated deliverables and milestones towards a security strategy that places prioritization on Norcross’s objectives.

• Provide Norcross with increased and enhanced cybersecurity controls for increased visibility and management while strengthening the city’s overall security posture.

• Norcross’ primary goal is the establishment of an effective Zero Trust infrastructure that will align with ever-changing threats to our municipality.

• Integrate and support the following cybersecurity elements including:

o Element 1 – Information Systems Management o Element 2 – Network Monitoring o Element 3 – Continuous Vulnerability Assessment o Element 4 – Adoption of Best Security Practices o Element 5 – Continuity of Operations o Element 6 – Threat Indicator Sharing o Element 7- Leverage of CISA services o Element 8 – IT/OT Modernization o Element 9 – Risk & Threat Strategy

4. SCOPE OF SERVICES

Phase 1: Risk Assessment & Gap Analysis Deliverable: Risk and compliance assessment report

• Evaluate our existing cybersecurity policies, procedures, and controls.

• Assess our current compliance to ensure alignment with relevant frameworks such as National Institute of Standards and Technology Cybersecurity Framework (NIST CSF)/ Health Insurance Portability and Accountability Act (HIPAA)/ Criminal Justice Information Services (CJIS)/ ISO 27001.

• Conduct analysis to identify deficiencies and potential exposure to the network and databases based upon previous penetration test results provided by the City of Norcross to the selected contractor upon signed Memorandum of Understanding

(MOU).

• Provide clear guidance and clarification regarding cloud-based platforms in conjunction with necessary security frameworks.

Phase 2: Policy & Framework Development Deliverable: Policy recommendations report Develop comprehensive, tailored cybersecurity policies covering:

• Access control and identity management (including Multi-Factor Authentication).

• Data protection, privacy, and secure cryptographic storage (at rest and in transit).

• Incident Response (IR) and Business Continuity / Disaster Recovery (BC/DR) planning.

• Vendor and third-party risk management

Phase 3: Training & Implementation Support Deliverable: Training roadmap and framework mapping chart

• Deliver targeted cybersecurity awareness training for general end-users.

• Provide advanced operational training for IT staff.

• Train-the-Trainer Model: Establish an internal capability by equipping designated personnel to deliver ongoing cybersecurity education within their respective departments.

• Deliver an actionable roadmap and framework mapping chart ensuring clear linkage between policy components and organizational goals

5. SCHEDULE OF EVENTS

Release of RFP June 18, 2026 Optional Pre-Proposal Meeting June 26, 2026 (10:00 a.m. EST) Deadline for Written Questions June 29, 2026 (5:00 p.m. EST) Proposals Due July 7, 2026 (10:00 a.m. EST) Proposal Evaluation July 2026 Contract Award August 2026

6. RESTRICTIONS ON COMMUNICATIONS WITH STAFF

All questions about this RFP should be sent to procurement@norcrossga.net. Please include the company name and the referenced RFP section in the following format:

Company Name

1. Question Citation of relevant section of the RFP

2. Question Citation of relevant section of the RFP

7. SUBMISSION GUIDELINES & INSTRUCTIONS

Firms must submit two paper copies and one USB copy of the proposal. A complete submission includes the following components:

� Cover letter/Executive summary Proposals should include a cover letter introducing the financial institution, indicating understanding of the scope of services requested, and highlighting key aspects of the proposal. Provide an overview of the firm’s operations, management, and customer service philosophies.

� Background

• Firm name, address, telephone numbers, and email addresses

• Years in business under present name and names and dates for previous names (if applicable)

• List of all parent or subsidiary companies

� Qualifications

• Describe experience with providing requested services to mailto:procurement@norcrossga.net municipal governments within past 3 years

• Resumes of proposed account representative and all proposed personnel assigned to the City of Norcross � Response to Scope of Services

Please provide a summary of your firm’s offerings for each of the services listed in Section 4, Scope of Services.

� Implementation Approach and Plan

Please clearly identify each phase, proposed timeline, and proposed roles to be performed. This section should include:

• Description of implementation approach by phase

• List and description of all implementation deliverables

• Outline of roles and responsibilities of City of Norcross staff during the implementation � References Form

Submission may be accompanied by a reference form containing at least 4 references (attached in Appendix B) OR a minimum of 3 letters of reference. References must be for projects of similar size and scope.

� Acknowledgement of Addenda Attached as Appendix D

� Certificate of Liability Insurance Insurance requirements detailed in “General Conditions” section.

� E-Verify Contractor & SAVE Affidavits (with required documentation) � Draft Contract Agreement � Cost Proposal

Cost proposal form is attached in Appendix C and must be submitted in a sealed envelope.

EVALUATION CRITERIA

The proposal evaluation will be made on the following criteria:

Evaluation Criteria Max Score Experience & Qualifications 20 Proposed Approach & Timeline 20 Training & Capacity Building 20 References 10 Cost Proposal 30 Local Firm Credit (Bonus) 5 Total 105

Experience & Qualifications – Experience and qualifications of the team personnel, as demonstrated by resumes, organizational chart, and other information provided. Experience of the firm in executing successful and relevant projects including other city-wide safety action plans.

Proposed Approach & Timeline – Evidence of thorough understanding of the project scope, quality and detail of the proposed approaches to the completion of the required tasks.

Evidence of team’s capacity and availability to provide the proposed services in a timely fashion. Evidence of ease of use and security.

References – Quality and relevance of references, as well as responsiveness of references contacted by City staff.

Local Firm—Businesses with a current and valid City of Norcross Business License shall receive a ‘local firm’ credit of 5 points added to their technical (pre-cost proposal) score. Businesses with a valid business license within the boundaries of Gwinnett County or another Gwinnett County city will receive a credit of 2.5 points.

Cost Proposal— The cost proposal will not factor into the committee’s evaluation of the technical proposal. Scores will be determined by weights assigned based on proposed cost.

The City of Norcross reserves the right to interview top-scoring firms.

GENERAL CONDITIONS

PROPOSERS ARE ADVISED TO THOROUGHLY UNDERSTAND THE GENERAL CONDITIONS AND

SPECIAL PROVISIONS, PRIOR TO SUBMITTING THEIR PROPOSALS.

I. QUALIFICATIONS

A. Proposals will be considered only from experienced and well‐ equipped Vendor(s) engaged in work of this type and magnitude.

B. Proposers may be required to submit evidence setting forth qualifications which entitle their company for consideration as a responsible Vendor. A list of work of similar character successfully completed within the last five years may be required, which lists the location, size, and scope for use on this work. Before accepting any proposals, the City may require evidence of the Vendor’s financial ability to successfully perform the work to be accomplished under the contract.

C. Proposers must provide their own materials for this contract.

D. Liability Insurance: During the term of the Agreement, Contractor shall, as its sole expense, secure and maintain in-force policies of insurance of the following types:

1. Workers’ compensation coverage in accordance with the statutory requirements of the jurisdiction in which Services are to be performed.

2. Employer’s liability insurance with a minimum of $250,000.

3. Comprehensive General Liability Insurance, subject to a limit for bodily injury and property damage combined at least $1,000,000 aggregate.

4. Automobile liability insurance subject to a limit for bodily injury and property damage combined, of at least $1,000,000 per occurrence.

E. Contractor shall furnish Client Certificates of Insurance evidencing the insurance coverages required. The certificates shall stipulate that should any of the above insurance policies be cancelled before the termination of this agreement, the issuing company will endeavor to mail thirty (30) days’ written notice to Client.

II. AUTHORITY TO SIGN

A. Proposers must ensure that the legal proper name of their firm and/or corporation is printed or typed as appropriate on all documents.

III. RIGHTS RESERVED

A. The City of Norcross reserves the right to reject any or all proposals, to waive informalities or to re‐advertise. It is understood that all proposals are made subject to this agreement, and that City of Norcross reserves the right to decide which proposal(s) it deems the most qualified. In arriving at this decision, full consideration will be given to the experience and qualifications of the Proposer, work of this type successfully completed and past performance with the City of Norcross.

B. Proposers are advised to examine the site(s) of the proposed work, as are necessary, to familiarize themselves with location conditions, which may affect the proposed work. Proposers are also advised to fully inform themselves regarding conditions under which the work will be performed.

The City of Norcross will not be responsible for the Proposer’s errors or misjudgment, nor for any information on location conditions or general laws and regulations.

C. Latest Financial Statements, certified audit, if available, prepared by an independent certified public accountant, or other financial documents or reporting may be requested by City. If requested, such statements must be provided within five (5) business days, or the bid proposal will be rejected.

D. Any unauthorized additions, conditions, limitations, or provisions attached to the Proposal shall render it informal and may be cause for rejection.

IV. AWARD OF CONTRACT

A. The contract will be awarded to the most qualified firm whose proposal will provide the best value and be the most advantageous to the City, experience, technical considerations, cost, and other factors considered. The City is to make the determination.

B. Prior to award of the Contract, the successful Proposer will be required to submit a schedule to the City, demonstrating the Proposer’s ability to commence and proceed in a timely manner. A Proposer’s failure to demonstrate the ability to proceed as required may result in contract cancellation.

C. Failure to demonstrate the ability for contract execution and progression will result in, at the City’s discretion, contract cancellation or re‐advertising of any and/or all these contracts.

D. Prior to execution of a Contract, a Utility Coordination Meeting may be required between Vendor(s), utility agencies and City of Norcross Public Works to ensure clarity and commitments concerning inter‐related work schedules.

V. PRODUCTION REQUIREMENTS

A. Time is of the utmost importance of this project. The successful Proposer will be required to commence work within ten (10) calendar days from the receipt of the Notice to Proceed and must carry on with utmost diligence to complete the work according to the specifications in the RFP.

VI. LOCATION AND SITE(S)

A. All work is within City limits of the City of Norcross, Georgia.

B. The Vendor shall accept the site(s) in its present condition and carry out all work in accordance with the requirements of the specifications as indicated in this RFP.

C. The Vendor is responsible for the location of above and below ground utilities and structures, which may be affected by the work.

VII. NON-COLLUSION

A. Vendor(s), by submitting a proposal, certify that the accompanying proposal is not the result of, or affected by, any unlawful act of collusion with any other person or company engaged in the same line of business or commerce, or any other fraudulent act punishable under Georgia or United States law.

VIII. MATERIALS

A. Unless otherwise specified in the Contract, Vendor shall provide and assume full responsibility for all services, materials, equipment, labor, and all other facilities and incidentals necessary for the completion of the Work.

B. All materials and equipment incorporated into the work shall be of good quality, except as otherwise provided in the Contract. All special warranties and guarantees required by the Specifications shall expressly run to the benefit of the City.

IX. CONTRACT REQUIREMENTS

The successful Vendor is required to do the following within ten (10) days of Notice:

A. Return to the City contract documents executed by the authorized representative attested by the corporate secretary treasurer.

B. Provide Insurance Certificates as specified in the RFP documents.

C. Failure to execute the Contract or furnish satisfactory proof of carriage of the insurance required within ten days after the date of Notice of Award of the Contract may be just cause for the annulment of the award and for the forfeiture of the RFP guaranty of City of Norcross, not as a penalty, but as liquidation of damages sustained. At the discretion of the City, the award may then be made to the next most qualified Vendor, or the work may be re‐advertised or constructed by City forces.

APPENDIX A

REFERENCES

Please provide accurate information and inform your references that the City of Norcross will follow up to perform reference checks. It will affect your scores if we are not able to contact your references, or they do not respond in time.

The City of Norcross will not serve as a reference, in the event that your Company worked with the City of Norcross previously.

Alternatively, Bidders are welcome to provide three (3) reference letters where they provided the same or similar services. Reference letters must be on official letterhead and signed by the point of contact of the agency where the service was performed.

References for _____________________________________________________________ Please provide a list of contact numbers, addresses and a contact person for at least four (4) projects completed (or in progress) having a similar specification and scope of work.

City of Norcross requests a minimum of four (4) references where work of a similar size and scope has been completed (or in progress).

Company Name: _______________________________________________________ Description of Project: __________________________________________________ Contract Dates: ______________________________________________________ Contact Person: ________________________________________________________ Telephone: ____________________________ Fax: ___________________________ Email address: ________________________________________________________

Company Name: _______________________________________________________ Description of Project: __________________________________________________ Contract Dates:______________________________________________________ Contact Person: ________________________________________________________ Telephone: ____________________________ Fax: ___________________________ Email address: ________________________________________________________

Company Name: _______________________________________________________ Description of Project: __________________________________________________ Contract Dates: ______________________________________________________ Contact Person: ________________________________________________________ Telephone: ____________________________ Fax: ___________________________ Email address: ________________________________________________________

APPENDIX A

REFERENCES

Company Name: _______________________________________________________ Description of Project: __________________________________________________ Contract Dates: ______________________________________________________ Contact Person: ________________________________________________________ Telephone: ____________________________ Fax: ___________________________ Email address: ________________________________________________________

Company Name: _______________________________________________________ Description of Project: __________________________________________________ Contract Dates: ______________________________________________________ Contact Person: ________________________________________________________ Telephone: ____________________________ Fax: ___________________________ Email address: ________________________________________________________

Company Name: _______________________________________________________ Description of Project: __________________________________________________ Contract Dates: ______________________________________________________ Contact Person: ________________________________________________________ Telephone: ____________________________ Fax: ___________________________ Email address: ________________________________________________________

APPENDIX B

COST PROPOSAL FORM

This form must be submitted in a sealed envelope.

Project Name: _______________________________________________________________

ITEM DESCRIPTION COST

1. Phase 1: Risk Assessment & Gap Analysis $

1. Phase 2: Policy & Framework Development $

2. Phase 3: Training & Implementation Support $

TOTAL COST: $

Please attach a clear breakdown of fees proposed above (including licensing fees, training, customer service, materials, etc.)

(Optional) Additional Modules:

APPENDIX B

COST PROPOSAL FORM

BIDDER, in compliance with the Request for Proposals associated with this project, having examined the Specifications with related documents and the site of the proposed work, and being familiar with all of the conditions surrounding the implementation of the proposed project, including the availability of materials and labor, hereby proposes to furnish all labor, materials and supplies, and to implement the project in accordance with the production and contract requirements, within the time set forth therein, and at the price(s) stated above. This price is to cover all expenses including overhead and profit incurred in performing the work required under the contract documents, of which this proposal is a part.

BIDDER verifies that all information provided in response to this bid package is truthful and accurate to the best of the Bidder’s knowledge and belief.

This bid is submitted to the City of Norcross by:

Firm Name: __________________________________________________________________

Authorized Representative: _____________________________________________________

Signature: ____________________________

Firm Address: ________________________________________________________________

APPENDIX C

ACKNOWLEDGEMENT OF ADDENDA

The undersigned hereby acknowledges receipt of the following Addenda:

Addendum Number Dated Acknowledge Receipt (initial)

No addenda were received:

Acknowledged for:

(Name of Firm)

Signature of Authorized Representative

Name (Print or Type)

Title

Date

APPENDIX D

CHECKLIST

FIRM NAME: _____________________________________________________

PROJECT: ________________________________________________________

DATE: ___________________________________________________________

Please use this checklist to ensure you have properly completed all forms and requirements.

Use of this appendix is not required but highly recommended to ensure responsiveness of proposal.

� Two Hard Copies & One Electronic Copy of Bid Package (including completed appendices and all required forms)

Bid Package Components:

� Cover letter/Executive summary � Background � Qualifications � Response to Scope of Services � Implementation Approach and Plan � References Form/Letters of Reference � Acknowledgement of Addenda � Certificate of Liability Insurance � E-Verify Contractor & SAVE Affidavits (with required documentation) � Draft Contract Agreement � Cost Proposal (in Sealed Envelope)

Mail or deliver to:

City of Norcross Public Works Department 345 Lively Avenue

Norcross, GA 30071 Attn: Charlene Marsh, Procurement and Capital Projects Manager

RFP IT 26-10 – CYBERSECURITY ASSESSMENT, COMPLIANCE, & GOVERNANCE SERVICES

APPENDIX D