Cybersecurity_Products,_Solutions,_and_Services_(Addendum_#1_Revision).pdf

CITY OF TUCSON

REQUEST FOR PROPOSAL

240160

CYBERSECURITY PRODUCTS, SOLUTIONS, AND SERVICES

Due Date: Monday, April 15, 2024

City of Tucson

255 W Alameda St

Tucson, AZ 85701

Procurement portal https://secure.procurenow.com/portal/tucson-az

Public Portal https://secure.procurenow.com/portal/tucson-az/projects/78911

PUBLISH DATE: March 14, 2024 https://secure.procurenow.com/portal/%7Bproject.government.code%7D https://secure.procurenow.com/portal/%7Bproject.government.code%7D/projects/%7Bproject.id%7D https://secure.procurenow.com/portal/%7Bproject.government.code%7D/projects/%7Bproject.id%7D

CITY OF TUCSON REQUEST FOR PROPOSAL NO. 240160

BUSINESS SERVICES DEPARTMENT Page 2 of 51 SHARED SERVICES PROCUREMENT DIVISION RESPONSIBLE CONTRACT OFFICER: Tracy Garcia

255 W. ALAMEDA, 6TH FLOOR, TUCSON, AZ 85701 PH: (520) 837-4114

Attachments:

A - Offer and Acceptance B - COT ARPA Terms and Conditions D - Axia Cooperative Solicitation Attachments for Cybersecurity COT F - Cybersecurity_Price_Sheet_Revised

BUSINESS SERVICES DEPARTMENT Page 3 of 51

A. NOTICE

A.1. CITY OF TUCSON

NOTICE OF REQUEST FOR PROPOSAL NO 240160

TITLE: Cybersecurity Products, Solutions, and Services

SUBMITTAL DUE DATE: Monday, April 15, 2024 AT 2:00 P.M. LOCAL AZ TIME

PRE-SUBMITTAL CONFERENCE DATE: Wednesday, March 27, 2024

TIME: 2:30 pm LOCAL AZ TIME

LOCATION: https://teams.microsoft.com/l/meetup-join/19%3ameeting_NGE3ZDdkZWMtN2RhZS00MDg3LTg4OTYtYjYyZWI4YzFmYjY5%40thread.v2/ 0?context=%7b%22Tid%22%3a%22d21e59ec-c208-43eb-aaf1-cf06d9a196e0%22%2c%22Oid%22%3a%222762af1b-3dac-4e48-a411-0268c7c615c0%22%7d Meeting ID: 282 815 068 77 Passcode: ExKiSX Or call in (audio only) +1 213-293-2303,,273329398# United States, Los Angeles Phone Conference ID: 273 329 398#

QUESTIONS SHALL BE DIRECTED TO: Tracy Garcia

(520) 837-4114 tracy.garcia@tucsonaz.gov

Posted Date: Thursday, March 14, 2024

Competitive sealed offers for the material or service specified in this solicitation must be submitted through the City’s online bidding system. No late submitted offer will be accepted or considered.

Reponses submitted in physical form or by facsimile or email will not be considered. Offerors are cautioned to commence the submittal process sufficiently ahead of time to allow for unanticipated delays resulting from things like a slow internet connection, internet outage, difficulty uploading large documents, differing system requirements, etc.

Questions about this solicitation must be addressed to the responsible Contract Officer listed herein.

BUSINESS SERVICES DEPARTMENT Page 4 of 51

B. INTRODUCTION

B.1. Summary

The City of Tucson’s Information Technology (IT) Department is tasked with securing all City systems and data, as well as working with other City Departments and City vendors to ensure that all IT initiatives are secure and built to City standards. Through this RFP and resulting contract(s), the City plans to acquire security services, products, and tools to enhance the City’s resilience and to improve the overall security posture of the City’s infrastructure and systems.

The aim of this RFP is to seek Offerors who can offer solutions that align with our technology framework and operational goals. Offerors should demonstrate an understanding of scalable, secure, and efficient technology solutions that can integrate seamlessly with our existing environment.

This section sets forth sufficient information to allow Offerors to submit proposals meeting minimum requirements but is not intended to limit a proposal's content or exclude any relevant or essential data.

Suppliers are encouraged to use their extensive knowledge and experience within the Cybersecurity industry to meet and exceed the City of Tucson’s requirements in responding to this RFP. Preference will be given to the Offeror(s) that offer a cost-effective solution for current specifications, future requirements, and ongoing service and support.

The City of Tucson recognizes that information technologies and services are rapidly evolving and advancing, and that Offerors may be testing new technologies or developing new services that are not yet available to the public at the time of RFP response. Once these technologies are generally available, The City of Tucson desires to have the ability to amend the Agreements awarded under this RFP to include these new technologies or service offerings at the City of Tucson’s sole and absolute discretion.

B.2. Background

NATIONAL CONTRACT REQUIREMENTS

The City of Tucson, as the Lead Procurement Agency, as defined in Attachment D, has partnered with Axia Coop LLC ("Axia Cooperative") to make the resultant contract (“Master Agreement”) from this solicitation available to other public agencies nationally, including state and local governmental entities; public and private primary, secondary and higher education entities; non-profit entities; and agencies for the public benefit (“Public Agencies”), through Axia Cooperative's cooperative purchasing program. The City of Tucson is acting as the contracting agency for any other Public Agency that elects to utilize the resulting Master Agreement. Use of the Master Agreement by any Public Agency is preceded by their registration with Axia Cooperative as a Participating Public Agency in Axia Cooperative's cooperative purchasing program. Attachment D contains additional information on Axia Cooperative and the cooperative purchasing agreement.

Axia Cooperative provides shared services and supply chain optimization to state, local, education, and other governmental entities. Axia Cooperative leverages the spend of public agencies nationwide to command the best prices on products and services. With executive support from the supplier along with pricing and sales commitments, Axia Cooperative provides marketing and administrative support for the Supplier that directly promotes the Supplier's products and services to Participating Public Agencies through multiple channels, each designed to promote specific products and services to

BUSINESS SERVICES DEPARTMENT Page 5 of 51

Public Agencies on a national basis. Public Agencies benefit from pricing based on aggregate spend and the convenience of a contract that has already been advertised and competed. The Supplier benefits from a contract that allows Participating Public agencies to directly purchase goods and services without the Supplier's need to respond to additional competitive solicitations. As such, the Supplier must be able to accommodate a nationwide demand for services and to fulfill obligations as a nationwide Supplier and respond to the Axia Cooperative documents (attachment D).

The City of Tucson anticipates spending approximately $5,000,000.00 over the full potential Master Agreement term for Cybersecurity Products, Solutions, and Services. While no minimum volume is guaranteed to the Supplier, the estimated annual volume of Cybersecurity Products, Solutions, and Services purchased under the Master Agreement through AXIA Cooperative is approximately $50,000,000.00. This projection is based on the current annual volumes among the Lead Procurement Agency, other Participating Public Agencies that are anticipated to utilize the resulting Master Agreement to be made available to them through AXIA Cooperative, and volume growth into other Public Agencies through a coordinated marketing approach between the Supplier and AXIA Cooperative.

B.3. Contact Information

Tracy Garcia Principal Contract Officer Email: tracy.garcia@tucsonaz.gov Phone: (520) 837-4114 Department:

Information Technology

B.4. Timeline mailto:tracy.garcia@tucsonaz.gov tel:(520)837-4114

BUSINESS SERVICES DEPARTMENT Page 6 of 51

Release Project Date March 14, 2024

Pre-Proposal Meeting (Non- Mandatory)

March 27, 2024, 2:30pm https://teams.microsoft.com/l/meetup-join/19%3ameeting_NGE3ZDdkZWMtN2RhZS 00MDg3LTg4OTYtYjYyZWI4YzFmYjY5%40thr ead.v2/0?context=%7b%22Tid%22%3a%22d2 1e59ec-c208-43eb-aaf1-cf06d9a196e0%22%2c%22Oid%22%3a%2227 62af1b-3dac-4e48-a411- 0268c7c615c0%22%7d

Meeting ID: 282 815 068 77 Passcode: ExKiSX

Or call in (audio only) +1 213-293-2303,,273329398# United States, Los Angeles Phone Conference ID: 273 329 398#

Question Submission Deadline April 5, 2024, 12:00pm

Proposal Submission Deadline April 15, 2024, 2:00pm https://teams.microsoft.com/l/meetup-join/19%3ameeting_NGE3ZDdkZWMtN2RhZS00MDg3LTg4OTYtYjYyZWI4YzFmYjY5%40thread.v2/0?context=%7b%22Tid%22%3a%22d21e59ec-c208-43eb-aaf1-cf06d9a196e0%22%2c%22Oid%22%3a%222762af1b-3dac-4e48-a411-0268c7c615c0%22%7d https://teams.microsoft.com/l/meetup-join/19%3ameeting_NGE3ZDdkZWMtN2RhZS00MDg3LTg4OTYtYjYyZWI4YzFmYjY5%40thread.v2/0?context=%7b%22Tid%22%3a%22d21e59ec-c208-43eb-aaf1-cf06d9a196e0%22%2c%22Oid%22%3a%222762af1b-3dac-4e48-a411-0268c7c615c0%22%7d https://teams.microsoft.com/l/meetup-join/19%3ameeting_NGE3ZDdkZWMtN2RhZS00MDg3LTg4OTYtYjYyZWI4YzFmYjY5%40thread.v2/0?context=%7b%22Tid%22%3a%22d21e59ec-c208-43eb-aaf1-cf06d9a196e0%22%2c%22Oid%22%3a%222762af1b-3dac-4e48-a411-0268c7c615c0%22%7d https://teams.microsoft.com/l/meetup-join/19%3ameeting_NGE3ZDdkZWMtN2RhZS00MDg3LTg4OTYtYjYyZWI4YzFmYjY5%40thread.v2/0?context=%7b%22Tid%22%3a%22d21e59ec-c208-43eb-aaf1-cf06d9a196e0%22%2c%22Oid%22%3a%222762af1b-3dac-4e48-a411-0268c7c615c0%22%7d https://teams.microsoft.com/l/meetup-join/19%3ameeting_NGE3ZDdkZWMtN2RhZS00MDg3LTg4OTYtYjYyZWI4YzFmYjY5%40thread.v2/0?context=%7b%22Tid%22%3a%22d21e59ec-c208-43eb-aaf1-cf06d9a196e0%22%2c%22Oid%22%3a%222762af1b-3dac-4e48-a411-0268c7c615c0%22%7d https://teams.microsoft.com/l/meetup-join/19%3ameeting_NGE3ZDdkZWMtN2RhZS00MDg3LTg4OTYtYjYyZWI4YzFmYjY5%40thread.v2/0?context=%7b%22Tid%22%3a%22d21e59ec-c208-43eb-aaf1-cf06d9a196e0%22%2c%22Oid%22%3a%222762af1b-3dac-4e48-a411-0268c7c615c0%22%7d https://teams.microsoft.com/l/meetup-join/19%3ameeting_NGE3ZDdkZWMtN2RhZS00MDg3LTg4OTYtYjYyZWI4YzFmYjY5%40thread.v2/0?context=%7b%22Tid%22%3a%22d21e59ec-c208-43eb-aaf1-cf06d9a196e0%22%2c%22Oid%22%3a%222762af1b-3dac-4e48-a411-0268c7c615c0%22%7d https://teams.microsoft.com/l/meetup-join/19%3ameeting_NGE3ZDdkZWMtN2RhZS00MDg3LTg4OTYtYjYyZWI4YzFmYjY5%40thread.v2/0?context=%7b%22Tid%22%3a%22d21e59ec-c208-43eb-aaf1-cf06d9a196e0%22%2c%22Oid%22%3a%222762af1b-3dac-4e48-a411-0268c7c615c0%22%7d

BUSINESS SERVICES DEPARTMENT Page 7 of 51

C. SCOPE OF WORK

C.1. Scope of Work

The City of Tucson’s Information Technology (IT) Department is tasked with securing all City systems and data, as well as working with other City Departments and City vendors to ensure that all IT initiatives are secure and built to City standards. Through this RFP and resulting contract(s), the City plans to acquire security services, products, and tools to enhance the City’s resilience and to improve the overall security posture of the City’s infrastructure and systems.

The aim of this RFP is to seek Offerors who can offer solutions that align with our technology framework and operational goals. Offerors should demonstrate an understanding of scalable, secure, and efficient technology solutions that can integrate seamlessly with our existing environment.

This section sets forth sufficient information to allow Offerors to submit proposals meeting minimum requirements but is not intended to limit a proposal's content or exclude any relevant or essential data.

Suppliers are encouraged to use their extensive knowledge and experience within the Cybersecurity industry to meet and exceed the City of Tucson’s requirements in responding to this RFP. Preference will be given to the Offeror(s) that offer a cost-effective solution for current specifications, future requirements, and ongoing service and support.

The City of Tucson recognizes that information technologies and services are rapidly evolving and advancing, and that Offerors may be testing new technologies or developing new services that are not yet available to the public at the time of RFP response. Once these technologies are generally available, The City of Tucson desires to have the ability to amend the Agreements awarded under this RFP to include these new technologies or service offerings at the City of Tucson’s sole and absolute discretion.

This RFP solicits proposals for a wide range of security-related products and services. The categories listed below represent key areas of interest but are not exhaustive. Contractors offering innovative solutions or services beyond those specified are encouraged to submit proposals detailing how their offerings can enhance our cybersecurity posture.

Although this section reflects the needs and requirements of the City of Tucson, the Participating Agencies for Axia Cooperative may have different requirements. The awarded Supplier(s) will have the ability to offer their Cybersecurity offerings nationally. Axia Cooperative Participating Agencies may sign a supplemental or usage agreement with the awarded Contractor(s) substantially based on the terms and conditions of the City of Tucson’s Agreement. Participating Agencies may elect to negotiate certain terms to conform to their purchasing and contracting requirements.

Technology Infrastructure Overview

1. Core Technologies: Our environment incorporates leading industry solutions for operating systems, networking, and security. We prioritize commercial Software as a Service (SaaS) applications and standard development platforms while minimizing custom-developed solutions.

2. Operational Scope:

The City of Tucson spans multiple departments, supported by a diverse workforce including employees, volunteers, and interns. Our computing environment includes a mix of desktop PCs, mobile devices, BUSINESS SERVICES DEPARTMENT Page 8 of 51 and servers, with a strategic approach towards virtualization. We utilize a variety of business systems that cater to specialized and general operational needs.

3. Data Centers: The City operates data centers that are central to our IT infrastructure, supporting a wide range of services and applications.

4. Cloud Adoption: A significant portion of our primary business systems leverages cloud technology, including but not limited to, organizational tools, customer relationship management, productivity suites, infrastructure services, and specific applications geared towards enhancing operational efficiency and security.

Processes

1. Successful Contractor(s) shall assign a service/support representative who will be responsible for quoting requests for as-needed products and services, coordinating the execution of work orders, providing reports, and escalation management. The City will designate a representative for services provided under this agreement.

2. The representatives will meet as required to discuss requirements, progress, and quality of all services rendered.

3. Contractor(s) shall not perform any work until directed to do so by the City in writing.

4. Contractor(s) shall produce and send to City’s representative an accurate accounting of all open work orders and work progress at least monthly.

Security

1. Information that may be collected by the Contractor(s) through the course of rendering services is considered privileged. Contractor(s) shall provide any and all information, findings and recommendations under privileged access, or a similar level of protection, in order to guard against revealing potential security issues that put the City, citizens, and businesses at risk.

2. Contractor(s) shall provide any and all information systems security findings, recommendations, and work materials via a secure file transfer method accessible by the City.

3. Contractor(s) shall possess all necessary equipment, materials, and support for remote connection to City servers and computers through dedicated, secure connections tailored exclusively for vendor use, in accordance with City access protocols. The City IT Department will facilitate these secure, vendor-specific connections into the network as required. Additionally, on-site access will be available when needed and upon mutual agreement.

4. Contractor(s) shall adhere to City IT security policy and standards, as may be updated from time to time, in providing the services. Contractor(s) shall implement security controls in accordance with the City’s Security Policy and Standards to assess any solution prior to first release or release of any major improvement or enhancement.

5. Contractor(s) shall protect City data in accordance with the City’s Security Policy and Standards.

6. Contractor(s) shall provide technical and professional services with the means and tools to remotely connect to City servers and computers via a secure connection and per City access protocols.

BUSINESS SERVICES DEPARTMENT Page 9 of 51

7. Offerors shall possess and can apply a detailed understanding of compliance requirements for the services offered in their proposal. Specialized security experience with municipal government and utilities in compliance with the following is considered especially valuable:

• CJIS

• PCI-DSS

• HIPAA

• FERPA

• FIPS

• FISMA

• Privacy, Industrial Control Systems (ICS)

8. Contractor(s) providing services must have their own equipment required to provide the services for which they are responding. The City will not pay for Contractor(s) equipment.

9. All City data provided to the Contractor(s) for the performance of the services specified herein is owned by the City and must be returned to the City upon contract termination.

10. Contractor personnel working on sensitive information and/or in secured areas may be required to submit to a background check. Certain personnel may be barred from working based on the results of the background check, and other conditions may be required by the City. The City will not disclose the details regarding why a particular worker is barred.

11. Contractor personnel involved in providing Cybersecurity services to the City may be required by the City to sign an individual confidentiality agreement and/or nondisclosure agreement.

12. The Contractor(s) shall contract with an external auditor to assess vendor’s security compliance against City’s and/or NIST’s security standards.

Category-Specific Scope of Work

1. The scope of the RFP includes the following seven categories. Interested suppliers may submit a single RFP response encompassing any one of the seven categories including more than one category.

The City of Tucson will review and evaluate responses per category:

a. Security Solutions & Tools

b. Identity and Access Management (IAM) Solutions

c. Data Security and Privacy

d. Security Consulting and Advisory Services

e. Regulatory Compliance and Governance Services

f. Security Architecture and Integration Services

g. Emerging Technologies and Future-Proofing Services

Please note the submission guidelines for each category.

BUSINESS SERVICES DEPARTMENT Page 10 of 51

C.2. Category 1 – Security Solutions & Tools

Objective: Secure cloud/on-prem environments, applications, and data across multiple platforms

Scope of Solutions & Tools Required:

• Advanced Data Encryption techniques, including application-level encryption for sensitive data.

• Enhanced Identity and Access Management features, such as adaptive authentication and risk-based access control.

• Cloud Workload Protection Platforms (CWPP) for hybrid and multi-cloud environments, offering deep security visibility and compliance monitoring.

• Cloud Security Posture Management (CSPM) to identify misconfigurations and enforce compliance standards across cloud accounts.

• SaaS Management Platforms for comprehensive oversight over cloud application usage, shadow IT, and third-party apps integration.

• Secure Access Service Edge (SASE) solutions that combine network security functions with WAN capabilities to ensure secure and fast cloud access.

• Cloud Access Security Brokers (CASBs) for real-time threat protection, compliance scanning, and encryption across cloud services.

• Cloud Data Compliance Management, ensuring adherence to GDPR, CCPA, HIPAA, and other regulatory frameworks.

• Web Application Firewall (WAF) and DDoS Mitigation to protect cloud services from web application attacks and denial-of-service attacks.

Submission Guidelines for Category 1:

Offerors are requested to submit proposals that:

• Provide a Comprehensive Overview: Detail your service offerings within the specified categories, focusing on how your solutions address the outlined objectives and scope of services required.

• Demonstrate Experience and Success: Share evidence of your expertise and achievements in implementing solutions that secure cloud/on-prem environments, manage identity and access, and protect data privacy across various platforms. Include case studies or examples of previous successful deployments.

• Detail Solution Capabilities: Explain the scalability, interoperability, customization, and integration capabilities of your solutions. Highlight how your services can adapt to and grow with organizational needs.

• Support and Maintenance: Offer information on the ongoing support, maintenance, and any training services provided to ensure effective and sustained use of your solutions.

BUSINESS SERVICES DEPARTMENT Page 11 of 51

C.3. Category 2 – Identity and Access Management (IAM) Solutions

Objective: Secure system and data access with state-of-the-art IAM solutions, leveraging emerging technologies for enhanced security and streamlined user experiences.

Scope of Solutions & Tools Required:

• Passwordless Authentication: Solutions that facilitate secure, passwordless access, employing next-generation tools such as FIDO2 security keys, mobile authentication apps, biometric authentication systems (e.g., facial recognition, fingerprint scanners), and smart cards. These technologies should offer a seamless user experience while providing robust security against common attack vectors.

• Behavioral Biometrics & AI Risk Assessment: Solutions using AI and machine learning to analyze user behavior patterns for continuous authentication and dynamic risk assessment.

The City is interested in technologies that can identify anomalies in user behavior, offering an additional layer of security.

• Adaptive Access Controls: Demand systems that implement SSO and MFA, utilizing contextual and adaptive policies based on real-time risk assessments. These controls should adjust authentication requirements dynamically, factoring in user location, device security posture, time of access, and typical behavior patterns.

• Privileged Access Management (PAM): Solutions with advanced monitoring capabilities, including session recording and AI-driven analytics, to safeguard privileged accounts and detect unauthorized or suspicious activities.

• Public Key Infrastructure (PKI): Systems for digital certificate and encryption key management that ensure secure communications and data protection. The City is interested in solutions that streamline certificate issuance, renewal, and revocation processes.

• Decentralized Identity Management: Explore the use of blockchain or distributed ledger technology for secure, user-managed identity verification. Solutions should allow users to control their identity data and share it securely with trusted entities.

• Secure Access Delegation & Federation: Solutions facilitating secure access delegation and identity federation using standards like OAuth, OpenID Connect, and SAML, ensuring safe and efficient cross-domain authentication and authorization.

• Automated Secrets Management: Automated tools for managing digital secrets, emphasizing the secure storage, rotation, and access control of API keys, credentials, and other sensitive configuration data.

Submission Guidelines for Category 2:

Offerors are requested to submit proposals that:

• Provide a Comprehensive Overview: Detail your service offerings within the specified categories, focusing on how your solutions address the outlined objectives and scope of services required.

• Demonstrate Experience and Success: Share evidence of your expertise and achievements in implementing solutions that secure cloud/on-prem environments, manage identity and access, BUSINESS SERVICES DEPARTMENT Page 12 of 51 and protect data privacy across various platforms. Include case studies or examples of previous successful deployments.

• Detail Solution Capabilities: Explain the scalability, interoperability, customization, and integration capabilities of your solutions. Highlight how your services can adapt to and grow with organizational needs.

• Support and Maintenance: Offer information on the ongoing support, maintenance, and any training services provided to ensure effective and sustained use of your solutions.

C.4. Category 3 – Data Security and Privacy

Objective: Protect sensitive information from breaches and ensure privacy compliance.

Scope of Solutions & Tools Required:

• Advanced Data Loss Prevention (DLP) technologies with machine learning capabilities for better detection of sensitive data exfiltration.

• Encryption-in-Use technologies, enabling secure data analytics and processing without exposing plaintext data.

• Anonymization and Pseudonymization techniques for enhancing privacy while maintaining data utility.

• Data Discovery and Classification Tools to identify and categorize sensitive and regulated data automatically.

• Regulatory Compliance Management Tools for real-time monitoring and reporting of compliance status with frameworks such as GDPR, HIPAA, and more.

Submission Guidelines for Category 3:

Offerors are requested to submit proposals that:

• Provide a Comprehensive Overview: Detail your service offerings within the specified categories, focusing on how your solutions address the outlined objectives and scope of services required.

• Demonstrate Experience and Success: Share evidence of your expertise and achievements in implementing solutions that secure cloud/on-prem environments, manage identity and access, and protect data privacy across various platforms. Include case studies or examples of previous successful deployments.

• Detail Solution Capabilities: Explain the scalability, interoperability, customization, and integration capabilities of your solutions. Highlight how your services can adapt to and grow with organizational needs.

• Support and Maintenance: Offer information on the ongoing support, maintenance, and any training services provided to ensure effective and sustained use of your solutions.

BUSINESS SERVICES DEPARTMENT Page 13 of 51

C.5. Category 4 – Security Consulting and Advisory Services

Objective: Engage expert advisory services to refine cybersecurity strategies, operational frameworks, and ensure compliance through focused guidance, workshops, and sessions.

Scope of Services Required:

• Cybersecurity Strategy Development: Assistance in crafting comprehensive cybersecurity strategies that align with organizational goals and risk tolerance, including strategic planning workshops and cybersecurity roadmap creation.

• Framework Implementation Guidance: Support for adopting and executing cybersecurity frameworks (e.g., NIST CSF, ISO/IEC 27001) with workshops and consulting for seamless integration.

• Risk Management Consultation: Expert advisory on risk management practices, from identification to mitigation, including facilitated risk assessment workshops.

• Policy and Governance Development: Help in formulating and updating security policies and governance structures to meet best practices and compliance standards, using policy development workshops and consulting.

• Incident Response Planning Support: Consulting on developing or enhancing incident response plans with template-based guidance, plan development workshops, and simulation exercises.

• Emerging Technology Advisory: Strategic insights into adopting emerging technologies securely, with services including innovation workshops and advisories on technology implications.

• Vendor Selection and Technology Guidance: Advisory services for selecting and implementing cybersecurity technologies, offering comparative analyses and selection framework support.

Submission Guidelines for Category 4:

Offerors are requested to submit proposals that:

• Demonstrate Capability: Show how your services can support organizations in strategic planning, risk management, policy development, and navigating the complex cybersecurity landscape.

• Leverage Emerging Technologies: Illustrate your approach to incorporating advanced technologies to enhance compliance and governance strategies.

• Ensure Effective Adoption: Provide examples or case studies where your services have led to the successful adoption of cybersecurity policies and technologies.

C.6. Category 5 – Regulatory Compliance and Governance Services

Objective: Partner with Contractor(s) to ensure strict adherence to cybersecurity regulations and the implementation of best practices across all operations.

Scope of Services & Tools Required:

BUSINESS SERVICES DEPARTMENT Page 14 of 51

• Comprehensive Compliance Audits and Gap Analyses: Solutions that offer thorough audits against international standards and regulations, pinpointing areas of non-compliance and providing actionable recommendations for remediation.

• Governance, Risk, and Compliance (GRC) Platforms: Advanced platforms that facilitate streamlined policy management, risk assessment, and compliance tracking. The City is interested in platforms that offer real-time insights and customizable reporting capabilities.

• Emerging Regulation Advisory Services: Expert advisory services that keep organizations ahead of the curve regarding upcoming cybersecurity laws, guidelines, and standards.

Proposals should outline how these services can help organizations proactively adjust to new regulatory requirements.

• Documentation and Reporting Tools: Tools designed for the efficient management of compliance evidence, audit trails, and regulatory submissions. These should support comprehensive documentation practices and simplify the reporting process to regulatory bodies.

Submission Guidelines for Category 5:

Offerors are requested to submit proposals that:

• Provide a comprehensive overview of their service offerings related to regulatory compliance and governance, highlighting key features and benefits.

• Demonstrate their experience and success in assisting similar organizations in achieving and maintaining compliance with relevant cybersecurity standards and regulations.

• Include case studies or examples of previous engagements in regulatory compliance and governance, showcasing their expertise and impact.

• Detail the scalability, interoperability, and customization capabilities of their solutions, explaining how these can be tailored to meet specific organizational needs.

• Offer information on support, maintenance, and any training services provided, emphasizing the vendor’s commitment to long-term partnership and success in compliance efforts.

C.7. Category 6 - Managed Security and Professional Services

Objective: Partner with experts to enhance cybersecurity operations through managed services, focusing on professional guidance and seamless technology integration.

Scope of Services Required:

• Managed Detection and Response (MDR): Seeking 24/7 security monitoring and incident response services for continuous oversight and rapid threat mitigation.

• Managed Vulnerability Identification and Remediation: Programs aimed at proactive identification and patching of security vulnerabilities to fortify defenses.

• Security Operations Center as a Service (SOCaaS): Solutions offering scalable, expert-led security operations to enhance threat detection and response capabilities.

BUSINESS SERVICES DEPARTMENT Page 15 of 51

• Managed Compliance Services: Assistance in achieving and maintaining continuous compliance with regulatory requirements, simplifying the compliance process for internal teams.

• Managed Endpoint Protection: Services incorporating advanced antivirus, endpoint detection and response (EDR), and mobile security solutions for comprehensive endpoint defense.

• Managed Network Security: Comprehensive network security services, including managed firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS), to safeguard critical network infrastructure.

• Managed Cloud Security: Customized solutions designed to protect cloud-based environments, supporting both multi-cloud and hybrid architectures.

• Professional Services and Integration: Emphasis on strategic consulting to develop actionable cybersecurity strategies, roadmaps, and specialized workshops. Additionally, the City seeks expertise in the seamless integration of security technologies within existing IT environments to enhance operational efficiency and cybersecurity posture.

Submission Guidelines for Category 6:

Offerors are requested to submit proposals that:

• Clearly outline their managed security services and professional service offerings, detailing how these services will enhance the organization's cybersecurity capabilities and compliance posture.

• Demonstrate a track record of successful service delivery in managed security, emphasizing experience in professional services and technology integration.

• Provide case studies or examples of successful implementations that highlight the impact of their services on client cybersecurity operations.

• Include information on the scalability, customization, and interoperability of their solutions to address evolving security challenges and business needs.

C.8. Category 7 - Emerging Technologies and Future-Proofing Services

Objective: Adopt and integrate advanced technologies for proactive threat defense and operational efficiency.

Scope of Services, Solutions & Tools Required:

• Artificial Intelligence (AI) and Machine Learning (ML) based security tools for predictive threat analysis, anomaly detection, and automated incident response, enhancing the efficiency and effectiveness of security operations.

• Blockchain technologies for secure, decentralized data management and identity verification, offering solutions for enhancing data integrity, securing transactions, and establishing trust without centralized authority.

BUSINESS SERVICES DEPARTMENT Page 16 of 51

• Internet of Things (IoT) security solutions for comprehensive device and network protection, addressing the unique challenges posed by the expanding IoT landscape, including device management, data security, and network segmentation.

• Future-proofing consultations to evaluate and implement emerging security technologies and methodologies, ensuring the organization’s security posture can adapt to future threats and technological advancements. This includes assessments of quantum-resistant cryptography, 5G network security strategies, and the integration of cybersecurity considerations into emerging tech like AR/VR for training and operational purposes.

Submission Guidelines for Category 7:

Offerors are requested to submit proposals that:

• Outline their capabilities and experience in delivering the specified services.

• Demonstrate a clear understanding of future cybersecurity challenges and their readiness to adapt to technological advancements.

• Include evidence of previous successful implementations or case studies.

• Detail the scalability, integration capabilities, and support services of their solutions.

BUSINESS SERVICES DEPARTMENT Page 17 of 51

D. INSTRUCTIONS TO OFFERORS

D.1. DEFINITION OF KEY WORDS USED IN THE SOLICITATION

For purposes of this solicitation and any subsequent contract, the following terms have the meanings set forth below:

City:The City of Tucson, Arizona

Contract:The legal agreement(s) executed between City and the Successful Offeror(s). The Contract will be deemed to include all the conditions and requirements set forth in this solicitation and any Addenda to the solicitation, all the Special Terms and Conditions and Standard Terms and Conditions, and all the terms of the Offer submitted by Offeror as finally negotiated and accepted by the City.

Contractor/Consultant:A Successful Offeror that enters into a Contract with the City.

Contract Representative:The City employee or employees who have been designated to act as the City contact for this solicitation process and who are responsible for monitoring and overseeing the Contractor's performance under the Contract.

Business Services Director:The contracting authority for the City, authorized to sign contracts and addenda thereto on behalf of the City.

May: Indicates something that is not mandatory but permissible.

May not:The indicated party is prohibited from taking the action.

Must: The action or condition is required.

Offer:Any proposal, statement of qualifications, bid, or other submission provided by an Offeror in response to this Solicitation.

Offeror: Each individual or entity that submits an Offer in response to this solicitation.

Successful Offeror: An Offeror who received a Notice of Award or a Notice of Intent to Award from the City.

Will:The indicated party is promising to take the action or abide by the condition.

D.2. PRE-SUBMITTAL MEETING

A Pre-Submittal Meeting will be held at the date and time stated on the cover page of this solicitation, if such a date and time is provided. Attendance at this meeting is not mandatory, but written minutes and/or notes regarding the meeting will NOT be provided, so attendance is encouraged. The purpose of this meeting will be to clarify the contents of this solicitation in order to prevent any misunderstanding of the City's position.

D.3. INQUIRIES

Any questions about this solicitation or the proposed Contract must be presented at the Pre-Submittal Meeting, if there is one (see above), or submitted in writing, via email, or through the online bidding system, to the Contract Officer by the Question Submission Deadline. The email must refer to the solicitation number and the paragraph number of the provision that the question concerns. The Contract

BUSINESS SERVICES DEPARTMENT Page 18 of 51

Officer may respond by email or may, if they deem it appropriate, address the question in a solicitation addendum or response through the question and answer portal in the online bidding system. Offeror may not rely on oral interpretations or clarifications about the solicitation; only questions answered in an email by the Contract Officer, posted through the online bidding system, or posted as a formal solicitation addendum will be binding.

D.4. ADDENDUM OF SOLICITATION

Solicitation Addenda will be posted on the City’s link to the online bidding website. Offeror is responsible for checking the webpage regularly for new solicitation addenda and must acknowledge each addendum to this solicitation in its submittal. Please note that vendors who have registered with the Business Services Department at https://procurement.opengov.com/portal/tucson-az and follow the City of Tucson will receive email notifications of solicitation addenda.

D.5. UNDERSTANDING SCOPE OF WORK

Before submitting an Offer to this solicitation, Offeror must familiarize itself with the Scope of Work, laws, regulations, physical conditions, and other factors affecting the obligations – including the expense and difficulty of fulfilling those obligations – that Offeror will have under the Contract if awarded to Offeror. No adjustment to the financial or other terms of the Contract will be justified by Offeror’s failure to fully understand or appreciate the Contract requirements or other factors affecting Contract performance.

D.6. PREPARATION OF OFFER

A. Form and Organization. If Offer forms are included in this Solicitation, Offeror’s Submittal must be on those forms. Supporting documentation must be arranged in a manner that follows and clearly refers to corresponding sections of the solicitation. Offeror may copy the submittal forms in order to complete them electronically but may not alter or rearrange them or change any paragraph designations.

B. Confidential Information. Any information in its submittal that Offeror wishes to be treated as confidential must be clearly marked “CONFIDENTIAL.”

C. Offer Contents. Offeror’s submittal must contain responses to all sections of this solicitation, any Offer forms provided must be completed and any requested supporting documentation must be attached.

D. Signatures. Offeror must include in their submittal signed copies of the Offer and Acceptance page. Any cover letter accompanying the proposal documents must be signed. Offeror must initial each erasure, interlineation or other modification in the submittal. The person signing and initialing on behalf of Offeror must be a person authorized to legally bind Offeror.

E. Prices. Where a unit price is provided it will govern over any erroneous extension of the price.

F. Time Periods. Periods of time, stated as a number of days, will be calendar days unless specifically stated otherwise.

G. Accuracy. Mistakes in preparation of its submittal confers on Offeror no right to modify or withdraw its submittal after the Submittal Deadline.

https://procurement.opengov.com/portal/tucson-az

BUSINESS SERVICES DEPARTMENT Page 19 of 51

H. Cost of Preparation. The City will not reimburse Offeror for the cost of developing, presenting, submitting or providing any response to this solicitation.

I. Subcontractors. Offeror must, in their submittal, list any subcontractors that it will utilize in the performance of the Contract if they are awarded the Contract and must describe their qualifications in detail.

J. Incomplete Information. Failure to include all requested information may have a negative impact on the evaluation of Offeror’s submittal.

D.7. PAYMENT DISCOUNTS

Payment discount periods shall be computed from the date of receipt of the material/service or correct invoice, whichever is later, to the date City’s payment warrant is mailed. Unless freight and other charges are itemized, any discount provided shall be taken on full amount of invoice. Payment discounts of twenty-one calendar days or more shall be deducted from the proposed price in determining the price points. However, the City shall be entitled to take advantage of any payment discount offered by a vendor provided payment is made within the discount period. The payment discount shall apply to all purchases and to all payment methods.

D.8. TAXES

The City is exempt from federal excise tax, including the federal transportation tax, but is not exempt from any other taxes, including state and local sales and excise taxes.

D.9. EXCEPTIONS TO CONTRACT PROVISIONS

By submitting an offer in response to this solicitation, Offeror is offering to enter into the Contract with the City. If Offeror wishes to modify any Contract terms and conditions, Offeror must, in its Offer, clearly identify the changes it is requesting. No requested modification will be deemed accepted by the City unless and until the City’s Business Services Director or their designee expressly accepts it in writing.

D.10. PUBLIC RECORD

Any documents submitted by Offeror in response to this solicitation will become the property of the City.

Except as set forth below with respect to Confidential Information, the Submittal will be deemed to be a public record available for review by the public after the award notification.

D.11. CONFIDENTIAL INFORMATION

The City is obligated to abide by the Arizona Public Records Law, A.R.S. §§ 39-101 through 39-161. If Offeror believes that any portion of its Offer, specification, protest or correspondence contains information that is confidential and subject to being withheld from disclosure in the event that the City receives a public records request to which the record is responsive, Offeror must, when the record is submitted, provide the Contract Officer written notification of that fact. The records or portions of records that Offeror wishes to be treated as confidential must also be clearly marked “CONFIDENTIAL” on their face. Pricing will not be treated as confidential.

BUSINESS SERVICES DEPARTMENT Page 20 of 51

If the City, after award notification, receives a public-records request the scope of which includes a document submitted by Offeror and marked "CONFIDENTIAL", the Contract Officer will make a written determination regarding whether the document will be provided to the requestor. If the Contract Officer determines that the document should be released, City will notify Offeror in writing. Unless Offeror, within 10 days after the date of that notice, obtains and provides to City an order from a court of competent jurisdiction prohibiting the City from releasing the documents, the City may release the documents without any liability to Offeror.

D.12. WHEN AND HOW TO SUBMIT OFFERS

In order to be considered, Offeror must, no later than the Offer Submittal Deadline, submit its Offer electronically through the City’s online bidding system:

https://procurement.opengov.com/portal/tucson-az

NOTE: THE ENTIRE OFFER MUST BE IN "“SUBMITTED"” STATUS IN THE CITY’S ONLINE

BIDDING SYSTEM IN ORDER TO BE CONSIDERED. RESPONSES THAT HAVE BEEN CREATED

IN THE SYSTEM, BUT THAT ARE NOT IN "“SUBMITTED"” STATUS BY THE OFFER SUBMITTAL

DEADLINE WILL NOT BE CONSIDERED.

D.13. CERTIFICATION OF NONCOLLUSION; CONFLICTS OF INTEREST

Offeror will not communicate, orally or in writing, with any member of the Mayor and Council, or with any City staff outside the Procurement Division of the Business Services Department, regarding this Solicitation. By submitting an Offer, Offeror warrants that:

A. Preparation and submission of the submittal did not involve collusion or other anti-competitive practices.

B. Offeror has not given, offered to give, nor intends to give at any time hereafter, any economic opportunity, future employment, gift, loan, gratuity, special discount, trip, favor, meal or service to a public servant in connection with this solicitation.

C. No person has been employed or retained to solicit or secure a Contract under this solicitation upon a promise of a commission, percentage, brokerage, or contingent fee.

D. No employee of the City involved in this Solicitation process, or any family member of such an employee, has any substantial financial interest in Offeror’s firm. No member of the City of Tucson Mayor and Council who has, or whose family member has, any substantial financial interest in Offeror’s firm will participate in any action taken by the Mayor and Council with respect to this Contract. The terms “relative” and “substantial interest” have the meanings assigned in A.R.S. § 38-502

The City may disqualify Offeror from further participation in the solicitation process if the City determines that any City employee or official involved in this Solicitation process has an actual or apparent conflict of interest or if Offeror has engaged in any collusion or anti-competitive practices.

BUSINESS SERVICES DEPARTMENT Page 21 of 51

D.14. WITHDRAWAL OF OFFER; BINDING OFFER

By submitting an Offer in response to this Solicitation, Offeror is offering to enter into the Contract with the City. Offeror may withdraw a submitted Offer at any time prior to the Offer Submittal Deadline.

Telephonic or oral withdrawals are not effective.

Offeror cannot withdraw an Offer that is in “submitted” status as of the Offer Submittal Deadline unless the Director of the Business Services Department consents in writing to the withdrawal. The Offer will be irrevocable for 90 days after the Offer Submittal Deadline.

D.15. DISCUSSIONS

The City may, at its discretion, conduct discussions with Offeror for the purpose of eliminating minor irregularities, informalities, or apparent clerical mistakes in Offeror’s submittal in order to clarify the offer and assure full understanding of, and responsiveness to, solicitation requirements.

D.16. VENDOR REGISTRATION; BUSINESS LICENSE

In order to be eligible for award of a Contract, Offeror must:

A. Register with the City’s Business Services Department. Registration can be completed at https://procurement.opengov.com/portal/tucson-az

B. Obtain a City of Tucson Business License or a written determination from the City's Business License Section that a license is not required. For questions contact the City's Business License Section at

(520) 791-4566 or email at license@tucsonaz.gov mailto:license@tucsonaz.gov

BUSINESS SERVICES DEPARTMENT Page 22 of 51

E. OFFER EVALUATION AND CONTRACT AWARD

E.1. PROPOSAL EVALUATION CRITERIA – (listed in relative order of importance)

A. Method of Approach

B. Qualifications and Experience

C. Support and Services

D. Price Proposal

E.2. INTERVIEWS

The City may interview some or all of the offerors at any point during the evaluation process. If interviews are conducted, information provided during the interview process will be taken into consideration in the evaluation process. The City will not reimburse the Offeror for any costs Offeror incurs during its participation in the interview process.

E.3. ADDITIONAL INVESTIGATIONS

The City may undertake any additional investigations it deems appropriate to evaluate the competence and financial stability of any offeror.

E.4. OTHER INFORMATION

Information that evaluation committee members have about an offeror beyond what is provided in the offeror’s Offer may be taken into consideration during the evaluation process.

E.5. PRICE

A. Tax Offset Policy. If applicable under Section 28-18(6) or Section 28-17(7)(d) of the Tucson Procurement Code, the City will include the amount of all business privilege taxes other than the City’s in evaluating the pricing component of each Offer.

B. Payment Discounts. Any discounts offered by Offeror for payments made within 21 calendar days or more will be deducted from the proposed price in evaluating an offeror’s pricing.

However, the City may take advantage of any early- or timely-payment discounts offered by a vendor. Any proposed payment discount will apply to all purchases and to all payment methods

E.6. CITY’S RIGHT TO WAIVE DEFECTS OR REJECT OFFERS

Notwithstanding any other provision of this solicitation, the City may:

A. Waive any immaterial defect or informality; or

B. Reject any or all submittals, or portions thereof; or

BUSINESS SERVICES DEPARTMENT Page 23 of 51

C. Reissue the solicitation.

E.7. CONTRACT NEGOTIATIONS

At the City’s discretion, it may negotiate with one or more responsible offerors to agree upon the final…