ESBD_420730_1747776204547_RFP_Managed Security Services Provider 2025 WCJC Final Draft.pdf

#25_000004

REQUEST FOR PROPOSALS (RFP)

For

Managed Security Service Provider (MSSP)

Due

June 19th, 2025 @ 11:00 AM

X:\Purchasing Files‐CB\RFP ‐ vCISO and Cybersecurity 2025\REQUEST FOR PROPOSALS.docx Page 2 of 17

INDEX

CONTENTS PAGE NUMBER

KEY DATES/MILESTONES AND CONTACT INFO

1.0 GENERAL INFORMATION/OVERVIEW

1.1 Background

1.2 Contract Type

1.3 Managed Security Service Provider Rep.

1.4 Pre‐proposal conference

1.5 Procurement Method

1.6 Proposal Closing Date

1.7 Preparation and Award

1.8 Duration of Proposal

1.9 RFP Revisions

1.10 Cancellations

1.11 Expenses

1.12 Protests/Disputes

1.13 Contractor Responsibilities

1.14 Mandatory Contractual Terms

1.15 Compliance

2.0 CONTRACTOR QUALIFICATIONS

2.1 Past Performance

3.0 SCOPE OF WORK

3.1 Objectives

3.2 Requirements

4.0 PROPOSAL SUBMISSION DETAILS

4.1 Submission Instructions

4.2 Solution Proposal

4.3 Rated Criteria

ADDENDA/BIDDER CERTIFICATION

ATTACHMENT A: CERTIFICATION GA‐48 16

PROPOSAL CHECKLIST 17

X:\Purchasing Files‐CB\RFP ‐ vCISO and Cybersecurity 2025\REQUEST FOR PROPOSALS.docx Page 3 of 17

KEY DATES/MILESTONES & CONTACT INFO:

WRITTEN QUESTIONS DEADLINE:

June 9th, 2025 by 5:00 PM

PROPOSAL SUBMITTAL DEADLINE:

June 19th, 2025 @ 11:00 AM

PROPOSAL DELIVERY LOCATION:

Cynthia Ward Associate VP of Finance/Controller 911 Boling Highway, A‐107B Wharton, Texas 77488

PROPOSAL ASSESSMENT PROCESS: June 21st – June 30th, 2025 (Tentative)

AWARD BY BOARD OF TRUSTEES:

July 15th, 2025 @ 6:30 PM (Tentative)

REVIEWING & EXECUTION OF

CONTRACT:

July 16th – August 15th, 2025 (Tentative)

ON‐SITE START OF SERVICE:

September 1st, 2025

Dates outlined are subject to change.

ALL QUESTIONS RELATED TO THIS RFP ARE TO BE DIRECTED VIA EMAIL TO:

Clarissa Bueno Director of Purchasing buenoc@wcjc.edu

X:\Purchasing Files‐CB\RFP ‐ vCISO and Cybersecurity 2025\REQUEST FOR PROPOSALS.docx Page 4 of 17

1.0 GENERAL INFORMATION

1.1 Background

Wharton County Junior College (WCJC) is a public, two‐year, comprehensive community college. To better serve our students, the college offers courses at four campuses in Wharton, Sugar Land, Richmond, and Bay City. In addition, the college offers classes in El Campo. We serve a diverse population with a variety of post‐secondary educational programs and services, including associate degrees, certificates, workforce training, cultural affairs, and leisure‐time activities. The college's tax district encompasses Wharton County and the Needville

Independent School District located in Fort Bend County. WCJC has a service area that includes

Wharton, Matagorda, and Colorado counties, as well as parts of Fort Bend, Jackson, and Austin counties. Our goal is to help all of our students reach their goals.

WCJC’s IT Department seeks a Managed Security Services Provider to assist with our efforts to monitor, analyze, and alert on security events within our Sentinel One, Fortigate Firewalls, Office 365, Google, and internal active directory domain systems. The business objective is to identify, score, and select an industry mature Managed Security Services Provider to work with WCJC’s IT Department to effectively analyzing log data, triage and alert analysts on detected security events that have the potential to compromise the institution cybersecurity posture, and collaborate tightly with analysts to manage the detection through remediation.

1.2 Contract Duration

The Contract shall start from the date of full contract execution by the parties (“Effective

Date”). As of the Notice to Proceed Date, the Contractor shall perform all activities required by the Contract, including the requirements of this solicitation, and the offerings in its Technical

Proposal, for the compensation described in its Financial Proposal. The Contract shall have an initial term of one to three years, contingent upon factors such as experience, pricing, and other relevant criteria, with the option to renew for one (1) additional year. Either party may terminate the agreement by providing at least one hundred twenty (120) days’ written notice prior to the renewal date established by the agreed‐upon effective date.

1.3 Managed Security Service Provider (MSSP) Representative

The MSSP Representative will be the Single Point of Contact (SPOC) prior to the award of the contract.

Clarissa Bueno – WCJC Director of Purchasing

(979) 532‐6305 buenoc@wcjc.edu

X:\Purchasing Files‐CB\RFP ‐ vCISO and Cybersecurity 2025\REQUEST FOR PROPOSALS.docx Page 5 of 17

1.4 Pre‐proposal Conference

A Pre‐Proposal Conference will not be held. However, questions can be submitted. Written questions from prospective contractors may be submitted via email. Emails must contain the

Solicitation Number and name in the subject line (25_000004 RFP‐MSSP). Please have all questions submitted to the Managed Security Services Provider (MSSP) Representative no later than June 9th, 2025 by 5:00pm.

1.5 Procurement Method

The Contract will be awarded in accordance with U.S. federal and state competitive procurement practices, Chapter 44 of the Texas Education Code, and WCJC’s Procurement

Manual.

1.6 Proposal Closing Date

All proposals must be received by the Associate VP of Finance/Controller, Cynthia Ward, no later the date and time listed on the Key Dates page above. Requests for extension of this date or time shall not be granted. Contractors mailing Proposals should allow sufficient mail delivery time to ensure timely receipt. Multiple/alternative Proposals will not be accepted. Proposals received after the closing date and time will not be considered.

1.7 Preparation and Award

Proposals should be prepared simply and economically and provide a straightforward and concise description of the Contractor’s Proposal to meet the requirements of this RFP. A

Contract shall be awarded to the Contractor submitting the Proposal that has been determined to be the most advantageous to WCJC considering price and evaluation factors set forth in this

RFP for providing the products/services as specified within. WCJC reserves the right to award in full or in part either portion of this RFP. Bidders should specify if they are participating in all aspects of the RFP or just a portion.

1.8 Duration of Proposal

Proposals submitted in response to this RFP are irrevocable for the latest of the following: 180 days following the closing date for submission of proposals, best and final offers (if requested), or the date any protest concerning this RFP is finally resolved. This period may be extended at

WCJC’s request only with the Contractor’s written agreement.

X:\Purchasing Files‐CB\RFP ‐ vCISO and Cybersecurity 2025\REQUEST FOR PROPOSALS.docx Page 6 of 17

1.9 RFP Revisions

If revisions to the RFP are necessary prior to the due date for Proposals, the SPOC shall provide addenda to all prospective Contractors that were sent this RFP, or which are otherwise known by the SPOC to have obtained this RFP. In addition, any Addenda to the RFP will be sent via email. It remains the responsibility of all prospective Contractors to check for any addenda issued prior to the submission of Proposals. Addenda made after the due date for Proposals will be sent only to those Contractors that submitted a timely Proposal and that remain under award consideration as of the issuance date of the addenda.

Acknowledgment of receipt of all addenda to this RFP issued before the Proposal due date shall be included in the Transmittal Letter accompanying the Contractor’s Technical Proposal. The acknowledgement of the receipt of addenda to the RFP issued after the Proposal due date shall be in the manner specified in the addendum notice. Failure to acknowledge receipt of an addendum does not relieve the Contractor from complying with the terms, additions, deletions, or corrections set forth in the addendum, and may cause the Proposal to be deemed not susceptible for award.

1.10 Cancellations

WCJC reserves the right to cancel this RFP, accept or reject any and all Proposals, in whole or in part, received in response to this RFP, to waive or permit the cure of minor irregularities, and to conduct discussions with all qualified or potentially qualified Contractors in any manner necessary to serve the best interests of the WCJC. WCJC also reserves the right, in its sole discretion, to award a Contract based upon the written Proposals received without discussions or negotiations.

1.11 Expenses

WCJC will not be responsible for any costs incurred by any Contractor in preparing and submitting a Proposal, in making an oral presentation, in providing a demonstration, or in performing any other activities related to submitting a Proposal in response to this solicitation.

1.12 Protests/Disputes

Any protest or dispute related to this solicitation or the Contract shall be subject to binding, private arbitration.

X:\Purchasing Files‐CB\RFP ‐ vCISO and Cybersecurity 2025\REQUEST FOR PROPOSALS.docx Page 7 of 17

1.13 Contractor Responsibilities

The successful Contractor shall be responsible for rendering products and services for which it has been selected as required by this RFP. All subcontractors shall be identified and a complete description of their role relative to the Proposal shall be included in the Contractor’s Proposal.

If a Contractor that seeks to perform or provide the products/services required by this RFP is the subsidiary of another entity, all information submitted by the Contractor, such as but not limited to, references, financial reports, or experience and documentation (e.g. insurance policies, bonds, letters of credit) used to meet minimum qualifications, if any, shall pertain exclusively to the Contractor, unless the parent organization will guarantee the performance of the subsidiary.

If applicable, the Contractor’s Proposal shall contain an explicit statement that the parent organization will guarantee the performance of the subsidiary. Each proposal must be accompanied by proof of insurance ("Certificate of Liability Insurance") completed by Bidder's insurance agency. This certifies that all contract requirements for insurance, as stipulated herein, can be met. Failure to provide proof of insurance is evidence of eligibility for award of the contract may be deemed grounds for disqualification of the proposal as non‐responsive. In the event Bidder fails to provide the required insurance certificate within ten (10) calendar days after receipt of the Agreement, such failure may be construed by WCJC as abandonment of the proposal, and WCJC may annul the award.

While experience and documentation of a Contractor’s parent company may be used to satisfy minimum qualifications, a parental guarantee of the performance of the Contractor under this

Section will not automatically result in crediting the Contractor with the experience and/or qualifications of the parent under any evaluation criteria pertaining to the actual Contractor’s experience and qualifications. Instead, the Contractor will be evaluated on the extent to which

WCJC determines that the experience and qualifications of the parent are transferred to and shared with the Contractor, any stated intent by the parent in its guarantee of performance for direct involvement in the performance of the Contract, and the value of the parent company’s participation as determined by WCJC.

1.14 Mandatory Contractual Terms

By submitting a Proposal in response to this RFP, the Contractor, if selected for award, shall be deemed to have accepted the terms and conditions of this RFP and the Contract. The Contract shall reflect the requirements and provisions of the RFP. Any exceptions to this RFP shall be clearly identified as such in the Executive Summary of the Technical Proposal. The volume and severity of exceptions to the terms of the RFP, will be considered in the evaluation process, and may be grounds for finding a Contractor not reasonably susceptible for award.

X:\Purchasing Files‐CB\RFP ‐ vCISO and Cybersecurity 2025\REQUEST FOR PROPOSALS.docx Page 8 of 17

1.15 Compliance

By submitting a Proposal in response to this RFP, the Contractor, if selected for award, agrees that it will comply with all federal, State, and local laws applicable to its activities and obligations under the finalized Contract. As applicable, the person submitting a response to this

RFP must complete and submit a Conflict‐of‐Interest Questionnaire form (“CIQ”) in a format approved by the Texas Ethics Commission. The form is to be sent to the Associate V.P. of

Finance/Controller. A copy of the form can be found at the Texas Ethics Commission web site.

2.0 Contractor Qualifications

2.1 Past Performance

The successful proponent shall have relevant experience providing Managed Security Services

Provider (MSSP) solutions to organizations of similar size and scope (500+ employees) with similar public sector and industry considerations.

3.0 SCOPE OF WORK

3.1 Objectives

The objective of this RFP is to identify a partner and develop a streamlined process to efficiently manage a preferred Managed Security Services Provider program. Though the intent is to identify one primary partner, WCJC may extend to multiple partners, if warranted.

Our objective is to understand the full portfolio of services and options that you offer and to match supplier capabilities with WCJC’s requirements. WCJC will focus on like‐for‐like offers.

However, we also look for potential incremental expense reduction opportunities that might be obtained from alternative options of equal or greater quality and/or improvements to WCJC’s business processes.

Wharton County Junior College employs a dynamic workforce, which includes approximately

326 Full time and 272 part‐time faculty and staff across 4 campuses servicing ~5,500 students a semester.

3.2 Requirements

The Partner shall meet the requirements detailed within this section at a minimum, including samples of Service Level Agreement, invoice, and monthly reporting. In addition, selected vendor(s) will commit to Quarterly Business Reviews. The successful proponent will be expected to work closely with the organization’s stakeholders. Below are several requirements

X:\Purchasing Files‐CB\RFP ‐ vCISO and Cybersecurity 2025\REQUEST FOR PROPOSALS.docx Page 9 of 17 and questions. Please provide clear responses to the below (preferred) or provide reference location within your proposal for WCJC review.

General RFP Terms and Conditions

The successful proponent will be expected to work closely with the organization’s stakeholders to:

Assign a dedicated account manager or single point of contact for day to day management, invoicing, and escalations.

Meet for monthly checkpoints to assess success, address any gaps or technical issues.

Present results/reporting to key stakeholder and leadership groups as required.

Ensure capability of supplying product and services in sufficient quantity, as needed to meet demand.

Managed Security Services Provider (MSSP) Solution Requirements

WCJC seeks a Managed Security Service Provider (MSSP) solution that can deliver comprehensive cyber assurance services and advanced monitoring and response capabilities that complement and integrate with the existing Security Group. The solution must provide continuous, 24x7 security monitoring, threat detection, and incident response to safeguard customer assets from evolving cyber threats.

Ensure MSSP roadmap that WCJC can layer in services overtime as existing solution expire or are deprecated.

Company Technical Profile

Desktop OS Types: Windows 10, Windows 11

Multiple Server OS Types: Windows 2016‐2022, Linux, and Unix Variants (85 total)

Firewall Vendors: FortiNet (4 campus firewalls)

Database Vendors: Zogotech, Microsoft SQL, Oracle (until November 2025)

Locations: 4 campuses

Servers: 85 (Down to around 50 by November 2025)

Employees: 326 full‐time and 272 part‐time

2K Endpoints

One Data Center

Multiple SAAS services (Ellucian Banner, brightspace, Office365, Google workspace)

Multiple Compliance Requirements (TAC202, HIPAA, FERPA, FTC financial safeguards)

Current Solutions

X:\Purchasing Files‐CB\RFP ‐ vCISO and Cybersecurity 2025\REQUEST FOR PROPOSALS.docx Page 10 of 17

Barracuda Email Filtering with impersonation and incident response protection

Sentinel One EDR on all college managed endpoint and server devices

1 on‐premise Nessus Vulnerability Management Service

Common Solution Criteria

Confirm that you can meet the criteria identified or answer the questions outlined below.

Qualifications and Staffing

Implementation and Service Methodology

Security Event Monitoring

Security Device Management

Security Information Management

Advanced Analytics and Capabilities

Vulnerability Management Services

Incident Response

Operational Technology Capabilities

Internet of Things Capabilities

Portals, Reports and Dashboards

Service Management

Qualifications and Staffing

Please provide a company overview including industry, size, long‐term vision, strategy, and how these employees are geographically distributed.

Please describe your service approach and experience working in Higher Education. This should include three or more references of companies using your service that are of

Higher Education. Please provide testimonials, success stories, lessons learned, and feedback from clients

What percentage of your staff has security certifications (list the certifications), and what is the average number of years of experience they have in performing security monitoring or security consulting? Are there any differences based on geographic location and/or SOC in terms of your staff's certifications and experience?

Provide a sample job description and/or resume for your security‐monitoring staff.

Include a summary of the technical skills/expertise, special capabilities required and certifications along with industry experience.

Describe the tasks and responsibilities of the vCISO and your customer support tiers, including the capabilities and location of staff at each tier.

X:\Purchasing Files‐CB\RFP ‐ vCISO and Cybersecurity 2025\REQUEST FOR PROPOSALS.docx Page 11 of 17

Please describe your experience working with compliance standards such as TAC202, FERPA, GLBA, TDPSA (similar to GDPR), HIPAA, etc.

Transition and Service Methodology

Provide a brief overview of your transition approach

Explain your anticipated timeline for transition to your service.

Please, provide a sample transition plan

Describe your methodology to provide education to WCJC partner teams on the processes and methodologies that will need to be adopted to maximize value of the service

Implementation and Service Methodology

Are your SOCs staffed 24/365? Describe your approach to supporting 24/365 remote security event monitoring and device/agent management.

Will your services require the use of proprietary technology that WCJC must purchase or install? If so, please list all pertinent information related to this technology, including hardware, software, networking, middleware, and database requirements. Include any associated costs as a separate line item in your quote.

Security Event Monitoring

Indicate the capabilities of your services to monitor our firewall, EDR solution, vulnerability data, etc.

Describe the typical workflow and process that occurs when the security analytics detects a security event, beginning with how that is presented to a SOC analyst for evaluation through the triage, validation, prioritization, and customer alerting/notification process. Indicate where activities are automated versus manually performed by analysts.

Advanced Analytics and Capabilities

Describe your detailed cybersecurity offerings and expertise for assurance and operations.

Describe any specific network monitoring and/or network forensics features, capabilities, or offerings to detect advanced, targeted attacks.

Describe any specific payload analysis features, capabilities, or offerings to detect advanced, targeted attacks.

Describe any specific endpoint behavior analysis and/or endpoint forensics features, capabilities, or offerings to detect advanced, targeted attacks.

X:\Purchasing Files‐CB\RFP ‐ vCISO and Cybersecurity 2025\REQUEST FOR PROPOSALS.docx Page 12 of 17

Describe any managed detection and response‐type service offerings (e.g., managed endpoint detection and response, threat hunting, remote response, and containment).

Service Management

Indicate the frequency of meetings or teleconferences to review performance, issues, threat environment and responses. Explain the types of analyst and account management support provided during those meetings.

Describe your experience preparing organizations for audit readiness. What access to internal‐auditing documentation will you provide if our auditors, customers, or business partners require this documentation in support of legal, regulatory, or contractual requirements? What is your process for requesting documentation? What are the time frames to which you will commit for producing documentation?

Describe how WCJC's data (including data generated by your company) about security events and incidents affecting WCJC will be governed and protected in transit. Consider this from a technology perspective, as well as via processes and procedures. How will the treatment of WCJC 's confidential data assist with better job performance (e.g., creating internal architecture and topology maps)?

For any logging of security events being done from any of service, or appliance, (ex.

Office365, Google, Firewalls) is this data being stored and housed in the U.S.?

If the data is not stored in the United States, please indicate the country of storage.

Provide examples of how your company has met specific regulatory or statutory requirements to the data within specific geographic or political boundaries. Provide answers only for regions or specific countries where there is concern.

Pricing

Pricing quotes will remain in effect for 60 days, following full RFP submission. Agreed upon pricing will be firm for the duration of the contract. Should a price increase be warranted, the contracted company will provide an addendum to WCJC 30 days prior to the effective date, detailing justification for the increase.

Invoices should be consistently accurate and reflect true charges incurred by WCJC. Failure to provide accurate invoices will result in a written warning provided by WCJC and may ultimately result in termination of the contract.

Please describe your detailed pricing structure and contract term.

Please provide the name, title and appropriate contact information of the authorized negotiator or contract‐signing agent.

Provide the base cost and pricing methodology.

X:\Purchasing Files‐CB\RFP ‐ vCISO and Cybersecurity 2025\REQUEST FOR PROPOSALS.docx Page 13 of 17

Provide details on one‐time costs and recurring costs.

4.0 PROPOSAL SUBMISSION DETAILS

4.1 Submission Instructions

Proposals shall be delivered or mailed in a sealed envelope, which is to be properly identified with the RFP project name, (RFP‐Managed Security Service Provider) and the name and address of Bidder. The Contractor shall submit one (1) original and three (3) complete copies of the Managed Security Services Provider (MSSP) proposal to Cynthia Ward, Associate Vice

President of Finance/Controller, no later than the due date specified on the Key Dates page

(page 3) of this RFP.

4.2 Solutions Proposal

The Proposal shall include all items detailed below. In addition to the following instructions, responses in the Contractor’s Proposal must be able to be directly mapped to the RFP.

The Solutions Proposal shall include the following documents and information in the order specified as follows.

Title Page and Table of Contents

Claim of Confidentiality

Executive Summary

Bid Proposal o Solution Proposal o Licensing & Pricing Schedule

With your bid sheet as a base for possible licensing options, but not limited to

Bundled Licensing Options for MSSP services

A la Carte Licensing for individual services

Each major aspect within the individual components of Section 3.2

Requirements need to be priced out.

o Additional Financial Factors

Bid/Solution base questions answered/requirements o Managed Detection and Response Capability for on‐premise and cloud applications/services.

Solution will provide 24x7 Coverage

Solution must store data within the Continental United States.

X:\Purchasing Files‐CB\RFP ‐ vCISO and Cybersecurity 2025\REQUEST FOR PROPOSALS.docx Page 14 of 17

Solution provides experienced Security Staff to operate Monitoring and

Incident Response

Solution will provide an SLA under 30 minutes for incident detection and response.

Solution will provide offer SOAR capabilities to perform automated incident response and triage.

Solution will integrate with Customer Service Management platform for ticketing operations.

Solution will leverage User Behavioral Analytics and Machine Learning to detect suspicious and malicious activity.

o Managed Vulnerability Service to assess customer assets and report on vulnerabilities inside the customer ecosystem, including externally hosted customer PAAS and IAAS services.

o Solution leverages Customer SIEM or bidder proposes a different SIEM platform.

o Flexible, scalable licensing model to support growth needs.

o Integration with Company’s Cloud Identity and Access Management Solution for

Authentication, Authorization, and Accountability (AAA).

o Capacity, Health, and Availability Monitoring with ability to set system alarms, thresholds, and send notifications using SMTP, Syslog, or API.

o Solution can resist or prevent tampering and unauthorized modification of software/hardware/services.

o Service is resilient and will continue to operate in the event the customer experiences a single data center outage.

Bidder must sign a service level agreement with WCJC.

Three References – Preferably similar in size and scope to WCJC.

4.3 Scoring Criteria

Grading Criteria (Total 100 points)

Technical expertise (20 points)

Experience & qualifications (10 points)

Service approach (15 points)

Compliance & Regulatory experience (15 points)

Reference & track record (10 points)

Pricing (30 points)

X:\Purchasing Files‐CB\RFP ‐ vCISO and Cybersecurity 2025\REQUEST FOR PROPOSALS.docx Page 15 of 17

ADDENDA: (if they apply) Bidder hereby acknowledges receipt of the following Addenda to the RFP, the provisions and requirements of which have been taken into consideration in the preparation of this proposal:

Addenda Numbers: # # # # #

BIDDER CERTIFICATION. The undersigned, on behalf of Bidder, certifies that this proposal is made without previous understanding, agreement or connection with any person, firm, or corporation making a proposal on the same project, and is in all respects fair and without collusion, fraud or unlawful acts.

It is further certified that the person whose signature appears below is the owner, partner or corporate officer of the Company and is legally empowered to bind the Company in whose name the proposal is entered.

Submitted this _____________ day of _______________, 2025 by and for the Company identified as follows:

COMPANY:

STREET ADDRESS:

CITY/STATE/ZIP:

SIGNATURE:

PRINTED NAME:

OWNER/PARTNER/OFFICER

TITLE:

TELEPHONE #:

EMAIL:

X:\Purchasing Files‐CB\RFP ‐ vCISO and Cybersecurity 2025\REQUEST FOR PROPOSALS.docx Page 16 of 17

ATTACHMENT A

Certification of Compliance with Executive Order GA‐48

Pursuant to Executive Order GA‐48, issued by Governor Greg Abbott on November 19, 2024, the Supplier certifies that neither the company, nor any of its holding companies, subsidiaries, or affiliates, is:

A. Listed in Section 889 of the 2019 National Defense Authorization Act (NDAA); or B. Listed in Section 1260H of the 2021 National Defense Authorization Act (NDAA); or C. Owned by the government of a country on the U.S. Department of Commerce's foreign adversaries list under 15 C.F.R. § 791.4; or D. Controlled by any governing or regulatory body located in a country on the U.S. Department of

Commerce's foreign adversaries list under 15 C.F.R. § 791.4.

The Supplier further certifies that it does not engage in any contractual, business, or operational activities that would otherwise grant access, control, or influence to an entity meeting any of the above‐listed criteria.

If at any time during the term of the contract, the Supplier becomes aware of any such affiliation or activity, it shall immediately notify Wharton County Junior College. The contract may be subject to termination, and the Supplier may face legal action as deemed necessary by the College.

By signing below, the Supplier acknowledges and certifies compliance with this requirement:

Company Name

Signature of Authorized Official

Title of Authorized Official Date

X:\Purchasing Files‐CB\RFP ‐ vCISO and Cybersecurity 2025\REQUEST FOR PROPOSALS.docx Page 17 of 17

PROPOSAL CHECK LIST

The following information is enclosed with this proposal: (Mark applicable box)

Yes No

Certificate of Liability Insurance

Conflict‐of‐Interest Questionnaire form (“CIQ”)

Response to questions and submittal information

List of references

One (1) original PLUS three (3) complete copies of the Proposal(s), including submittal information. Original is to be marked "Original" and copies as "Copy"