ES-25-02 IT Cybersecurity Risk Assessment.pdf

Revised: June 2022 Page 1 of 7 Agency RFP Template

STATE OF NEVADA

Colorado River Commission of Nevada

100 N. City Parkway, Suite 1100 │ Las Vegas, NV 89106

Phone: 775-684-0170 │ Fax: 775-684-0188

Solicitation: 69CRC-S3063

For

IT Cybersecurity Risk Assessment

Release Date: 11/06/2024

Deadline for Submission and Opening Date and Time: 12/17/2024 @ 2:00 pm

Single point of contact for the solicitation:

John Sagmani

Phone, 702-486-2670

Email Address, jsagmani@crc.nv.gov

(TTY for Deaf and Hard of Hearing, 800-326-6868

Ask the relay agent to dial, 1-775-515-5173/V.)

TABLE OF CONTENTS

1. APPLICABLE REGULATIONS GOVERNING PROCUREMENT

2. PROJECT OVERVIEW

3. SCOPE OF WORK

4. ATTACHMENTS

5. TIMELINE

6. EVALUATION

7. MANDATORY MINIMUM REQUIREMENTS

8. CRITICAL ITEMS

9. SUBMISSION CHECKLIST

mailto:gkdavis@admin.nv.gov

Revised: June 2022 Page 2 of 7 Agency RFP Template

1. APPLICABLE REGULATIONS GOVERNING PROCUREMENT

1.1. All applicable Nevada Revised Statutes (NRS) and Nevada Administrative Code (NAC) documentation can be found at: www.leg.state.nv.us/law1.cfm.

1.2. Prospective vendors are advised to review Nevada’s ethical standards requirements, including but not limited to NRS

281A, NRS 333.800, and NAC 333.155.

2. PROJECT OVERVIEW

2.1. The State of Nevada, Colorado River Commission of Nevada is seeking proposals from qualified vendors to provide IT

Cybersecurity Risk Assessment services as described in the scope of work and attachments.

2.2. The State intends to award one (1) contract in conjunction with this Request for Proposals (RFP), as determined in the best interests of the State. The Colorado River Commission of Nevada shall administer contract(s) resulting from this solicitation. The resulting contract(s) are expected to be for a contract term of four years, subject to Board of Examiners approval.

2.3. AGENCY BACKGROUND

2.3.1. The Colorado River Commission of Nevada (CRC or Commission) was established in 1935 in anticipation of the completion of Hoover Dam, with the primary objective of safeguarding, managing, and maximizing the utilization of

Nevada’s water and hydropower resources. Comprising seven Commissioners, the CRC operates under a framework where four members are appointed by the Governor, and three members are appointed by the Southern Nevada Water

Authority (SNWA). The CRC’s core operational domains encompass hydropower, water and environmental management, power delivery for the Southern Nevada Water Authority and some of its member agencies. The

Commission is located near downtown Las Vegas NV in the “main” office where most of the employees work. A second location is used for our Power Deliver Group at a substation in Henderson NV

2.4. GOALS AND OBJECTIVES

2.4.1. The goal of this solicitation is to comprehensively identify, evaluate, and prioritize potential threats and vulnerabilities within the Commission’s information systems, allowing for informed decision-making to mitigate risks and protect critical data, ultimately aiming to maintain an acceptable level of security.

3. SCOPE OF WORK

3.1. See Attachments 4.1.1.

4. ATTACHMENTS

4.1. ATTACHMENTS INCORPORATED BY REFERENCE. To be read and not returned.

4.1.1. Attachment A - Scope of Work

4.1.2. Attachment B - Terms and Conditions for Services

4.2. ATTACHMENTS FOR REVIEW. To be read and not returned (unless redlining).

4.2.1. Attachment C – Standard Form Contract

4.2.2. Attachment D - Insurance Schedule

4.3. PROPOSAL ATTACHMENTS. To be completed and returned in proposal.

4.3.1. Attachment E - Cost Schedule

4.3.2. Attachment F - Proposed Staff Resume

4.3.3. Attachment G - Reference Questionnaire

4.3.4. Attachment H - Vendor Information Response – Must Be Signed

A. Vendor Contact Information

B. Vendor Information http://www.leg.state.nv.us/law1.cfm

Revised: June 2022 Page 3 of 7 Agency RFP Template

C. Payment Authorization for use of Procurement Card

D. Name of Individual Authorized to Bind the Organization

E. Vendor Certifications

F. Confidentiality and Certification of Indemnification

G. Certification Regarding Lobbying

5. TIMELINE

5.1. QUESTIONS. All questions regarding this solicitation shall be submitted using the Bid Q&A feature in NevadaEPro.

5.2. TIMELINE. The following represents the proposed timeline for this project.

5.2.1. All times stated are Pacific Time (PT).

5.2.2. These dates represent a tentative schedule of events.

5.2.3. The State reserves the right to modify these dates at any time.

A. Deadline for Questions .................................................................................. No later than 5:00 pm on 11/18/2024

B. Answers Posted .................................................................................................................. On or about 11/25/2024

C. Deadline for References................................................................................. No later than 5:00 pm on 12/13/2024

D. Deadline Proposal Submission and Opening ................................................. No later than 2:00 pm on 12/17/2024

E. Evaluation Period (estimated) ........................................................................................... 12/16/2024 - 01/13/2025

F. Selection of a Vendor (estimated) ...................................................................................... On or about 01/13/2025

G. BOE Approval (estimated) .................................................................................................................... 02/28/2025

H. Contract start date (estimated) ............................................................................................................... 03/05/2025

6. EVALUATION

6.1. Evaluation and scoring are conducted in accordance with NRS 333.335 and NAC 333.160-333.165.

6.1.1. Proposals shall be kept confidential until a contract is awarded.

6.1.2. In the event the solicitation is withdrawn prior to award, proposals remain confidential.

6.1.3. The evaluation committee is an independent committee established to evaluate and score proposals submitted in response to the solicitation.

6.1.4. Financial stability shall be scored on a pass/fail basis.

6.1.5. Proposals shall be consistently evaluated and scored based upon the following factors and relative weights.

A. Addressed all Scope of Work items

B. Provided examples of Contractor’s industry experience on all Scope of Work items

C. Provided example of final product/deliverables

D. Cost Factor

E. No redlines of State contract

6.1.6. Cost proposals will be evaluated based on the following formula.

A. Cost Factor Weight x (Lowest Cost Submitted by a Vendor / Proposer Total Cost) = Cost Score

6.1.7. Presentations

A. Following evaluation and scoring specified above, the State may require vendors to make a presentation of their proposal to the evaluation committee or other State staff, as applicable.

B. The State, at its option, may limit participation in vendor presentations to vendors above a natural break in relative scores from technical and cost scores.

C. Following presentations, the combined technical, cost, and presentation scores will become the final score for a proposal.

D. The State reserves the right to add additional criteria or presentations.

E. The State reserves the right to forego vendor presentations and select vendor(s) based on the written proposals submitted.

6.2. NEVADA-BASED BUSINESS PREFERENCE

Revised: June 2022 Page 4 of 7 Agency RFP Template

6.2.1. The State awards a five percent (5%) preference to Nevada-based businesses pursuant to NRS 333.3351 to 333.3356, inclusive.

6.2.2. Nevada-based business is defined in NRS 333.3352(1).

6.2.3. The term ‘principal place of business’ has the meaning outlined by the United States Supreme Court in Hertz Corp v.

Friend, 559 U.S. 77 (2010), typically meaning a business’s corporate headquarters.

6.2.4. To claim this preference a vendor must indicate it on their vendor account and submitted Quote in NevadaEPro.

6.2.5. This preference cannot be combined with any other preference, granted for the award of a contract using federal funds, or granted for the award of a contract procured on a multi-state basis.

6.3. INVERSE PREFERENCE

6.3.1. The State applies an inverse preference to vendors that have a principal place of business in a state other than Nevada and that state applies an in-state preference not afforded to Nevada based vendors, pursuant to AB28 passed in the 81st session of the Nevada Legislature.

6.3.2. The amount of the inverse preference is correlated to the amount of preference applied in the other state.

6.3.3. Vendors who meet this criterion must indicate it on their submitted Quote in NevadaEPro.

6.3.4. This preference cannot be combined with any other preference, granted for the award of a contract using federal funds, or granted for the award of a contract procured on a multi-state basis.

7. MANDATORY MINIMUM REQUIREMENTS

7.1. Pursuant to NRS 333.311 a contract cannot be awarded to a proposal that does not comply with the requirements listed in this section. The proposal shall include confirmation of compliance with all mandatory minimum requirements.

7.2. NEVADA LAW AND STATE INDEMNITY. Pursuant to NRS 333.339, any contract that is entered into may not: (1)

Require the filing of any action or the arbitration of any dispute that arises from the contract to be instituted or heard in another state or nation; or (2) Require the State to indemnify another party against liability for damages.

7.3. NO BOYCOTT OF ISRAEL. Pursuant to NRS 333.338, the State of Nevada cannot enter a contract with a company unless that company agrees for the duration of the contract not to engage in a boycott of Israel. By submitting a proposal or bid, vendor agrees that if it is awarded a contract, it will not engage in a boycott of Israel as defined in NRS

333.338(3)(a).

7.4. INDEMNIFICATION. Required contract terms on Indemnification: "To the fullest extent permitted by law, Contractor shall indemnify, hold harmless and defend, not excluding the State’s right to participate, the State from and against all liability, claims, actions, damages, losses, and expenses, including, without limitation, reasonable attorneys’ fees and costs, arising out of any breach of the obligations of Contractor under this contract, or any alleged negligent or willful acts or omissions of Contractor, its officers, employees and agents. Contractor’s obligation to indemnify the State shall apply in all cases except for claims arising solely from the State’s own negligence or willful misconduct. Contractors waive any rights of subrogation against the State. Contractor’s duty to defend begins when the State requests defense of any claim arising from this Contract."

7.5. LIMITED LIABILITY. Required contract terms on Limited Liability: "The State will not waive and intends to assert available NRS Chapter 41 liability limitations in all cases. The contract liability of both parties shall not be subject to punitive damages. Damages for any State breach shall never exceed the amount of funds appropriated for payment under this Contract, but not yet paid to Contractor, for the Fiscal Year budget in existence at the time of the breach. Contractor’s tort liability shall not be limited."

7.6. CONTRACT RESPONSIBILITY. Awarded vendor shall be the sole point of contract responsibility. The State shall look solely to the awarded vendor for the performance of all contractual obligations which may result from an award based on this solicitation, and the awarded vendor shall not be relieved for the non-performance of any or all subcontractors.

7.7. DATA ENCRYPTION. State IT requires that data be encrypted in transit and in rest.

7.8. STATESIDE DATA. State IT requires that State data assets must be maintained in the United States and data will not be held offshore.

7.9. NEVADA BUSINESS LICENSE. Pursuant to NRS 353.007, prior to contract execution the awarded vendor must hold

Revised: June 2022 Page 5 of 7 Agency RFP Template a state business license pursuant to NRS chapter 76 unless exempted by NRS 76.100(7)(b).

7.10. DISCLOSURE. Each vendor shall include in its proposal a complete disclosure of any alleged significant prior or ongoing contract failures, contract breaches, any civil or criminal litigation or investigations pending which involves the vendor or in which the vendor has been judged guilty or liable.

8. CRITICAL ITEMS

8.1. In addition to the Scope of Work and Attachments, the items listed in this section are critical to the success of the project.

These items will be used in evaluating and scoring the proposal. Vendor proposal should address items in this section in enough detail to provide evaluators an accurate understanding of vendor capabilities. Proposals that fail to sufficiently respond to these items may be considered non-responsive.

8.2. CONTRACT FORM. The State strongly prefers vendors agree to the terms of the attached Contract Form as is. Ability to agree to contract terms is a high priority to the State. Vendors who cannot agree to the contract as is must include a redlined Word version of the attached Contract Form with their proposal response. To the extent a vendor has prior contractual dealings with the State, no assumption should be made that terms outside those provided herein have any influence on this project.

8.3. INSURANCE SCHEDULE

8.3.1. The State strongly prefers vendors to agree to the terms of the attached Insurance Schedule as is. Vendors who cannot agree must explain which areas are causing non-compliance and attach a red line if necessary.

8.3.2. The awarded vendor shall maintain, for the duration of the contract, insurance coverages as set forth in the fully executed contract.

8.3.3. Work on the contract shall not begin until after the awarded vendor has submitted acceptable evidence of the required insurance coverages.

8.3.4. Failure to maintain any required insurance coverage or acceptable alternative method of insurance shall be deemed a breach of contract.

8.4. VENDOR BACKGROUND

8.4.1. Company background/history and why vendor is qualified to provide the services described in this solicitation.

8.4.2. Provide a brief description of the length of time the vendor has been providing services described in this solicitation to the public and/or private sector.

8.5. VENDOR STAFF RESUMES

8.5.1. A resume shall be included for each proposed key personnel, see Proposed Staff Resume.

8.5.2. A resume shall also be included for any proposed key subcontractor personnel.

8.6. SUBCONTRACTORS

8.6.1. Subcontractors are defined as a third party, not directly employed by the contractor, who shall provide services identified in this solicitation. This does not include third parties who provide support or incidental services to the contractor.

8.6.2. The proposal should include a completed Vendor Information Response form for each subcontractor.

8.6.3. The vendor shall not allow any subcontractor to commence work until all insurance required of the subcontractor is provided to the vendor.

8.6.4. The Vendor proposal shall identify specific requirements of the project for which each subcontractor shall perform services.

A. How the work of any subcontractor(s) shall be supervised

B. How channels of communication shall be maintained

C. How compliance with contracts terms and conditions will be assured

D. Previous experience with subcontractor(s)

8.7. VENDOR FINANCIAL INFORMATION

8.7.1. The information requested in this section is designated as confidential business information by the Administrator pursuant to NRS 333.020(5)(b) and is not public information pursuant to NRS 333.333.

Revised: June 2022 Page 6 of 7 Agency RFP Template

8.7.2. This information should be submitted as a separate attachment, flagged as confidential in NevadaEPro.

8.7.3. The proposed vendor shall provide the following financial information and documentation:

A. Dun and Bradstreet Number

B. Federal Tax Identification Number

C. The last two (2) full years and current year interim:

1. Profit and Loss Statements

2. Balance Statements

8.8. BUSINESS REFERENCES

8.8.1. The information requested in this section is designated as confidential business information by the Administrator pursuant to NRS 333.020(5)(b) and is not public information pursuant to NRS 333.333.

8.8.2. Vendors shall provide a minimum of three (3) business references from similar projects performed for private and/or public sector clients within the last five (5) years, see Reference Questionnaire.

8.8.3. The purpose of these references is to document relevant experience and aid in the evaluation process.

8.8.4. Business references should return the Reference Questionnaire directly to Single Point of Contact via email.

8.8.5. Business references will not be accepted directly from the proposed vendor.

8.8.6. The State will not disclose submitted references but will confirm if a reference has been received.

8.8.7. The State reserves the right to contact references during evaluation.

9. SUBMISSION CHECKLIST

9.1. This section identifies documents that shall be submitted to be considered responsive. Vendors are encouraged to review all requirements to ensure all requested information is included in their response.

9.1.1. Proposals must be submitted as a Quote through NevadaEPro, https://NevadaEPro.com.

9.1.2. Vendors are encouraged to submit a single file attachment per proposal section if possible.

9.1.3. Technical proposal information and Cost proposal information shall not be included in the same attachment.

9.1.4. Cost proposal attachment shall not be flagged as confidential in NevadaEPro.

9.1.5. Additional attachments may be included but are discouraged and should be kept to a minimum.

9.2. TECHNICAL PROPOSAL

A. Title Page

B. Table of Contents

C. Response to Mandatory Minimum Requirements

D. Response to Critical Items

E. Response to Scope of Work

F. Proposed Staff Resumes

G. Other Informational Material

9.3. PROPRIETARY INFORMATION. If necessary. Attachment should be flagged confidential in NevadaEPro.

A. Title Page

B. Table of Contents

C. Trade Secret information, cross referenced to the technical proposal

9.4. COST PROPOSAL

9.5. VENDOR FINANCIAL INFORMATION. Attachment should be flagged confidential in NevadaEPro.

9.6. SIGNED ATTACHMENTS

A. Vendor Information Response

B. Vendor Certifications

C. Confidentiality and Certification of Indemnification

D. Certification Regarding Lobbying https://nevadaepro.com/

Revised: June 2022 Page 7 of 7 Agency RFP Template

9.7. OTHER ATTACHMENTS. If necessary, not recommended.

9.8. REFERENCE QUESTIONNAIRES. Not submitted directly by vendor.