ESBD_487599_1770306182216_RFP 2026-006 Proposal Package (Final).pdf

REQUEST FOR PROPOSAL

RFP No. 2026-006 SCADA Support Maintenance, and On-Call Services

Issue Date: February 6, 2026

Questions Due: February 25, 2026, 5:00 P.M. CT Closing Date & Time: March 12, 2026, 2:00 P.M. CT Opening Date & Time: March 12, 2026, 2:01 P.M. CT

For Information Contact:

Melanie Wade, Purchasing Agent, 254-750-8098, or melaniew@wacotx.gov

RFP Opening Location:

Purchasing Services Office, 1415 N. 4th Street, Waco, Texas via Zoom Video Conferencing Only (Please see Page 3)

Zoom & Dial-In Information:

Please see Page 3

Purchasing Services Post Office Box 2570

Waco, Texas 76702-2570 Telephone 254 / 750-8060

Fax 254 / 750-8063 waco-texas.com

RFP 2026-006 Page 1 mailto:%20XXX@wacotx.gov mailto:melaniew@wacotx.gov http://www.waco-texas.com/

EUNA / BONFIRE ELECTRONIC BIDDING

The City of Waco is transitioning to Electronic Bidding, Proposals and Qualification (RFB/RFP & RFQ) submissions. These requests will be managed through the new City’s Data base system, EUNA / Bonfire.

We ask vendors to register with EUNA / Bonfire to access and respond to any advertisement for bids and services required by the City. Registration is secure and user friendly. Vendors can register at the link below. Once registered, vendors will be able to:

• Register with the City of Waco.

• Receive notifications for bids and services requests from the City.

• Stay updated on changes, addendums, open solicitations.

• Submit bids and proposals electronically.

• Vendors can inquire about the details and requirements of various bidding opportunities.

The City will still accept bids and proposals by mail or drop off. Notifications of changes, addendums and updates will also be available on the City’s website as well as other media outlets the City uses for solicitations.

The City appreciates your participation. If you have questions during the electronic bid/proposal process, please contact the issuing buyer, whose contact information can be found in the solicitation document. You can also contact EUNA / Bonfire with registration or customer support issues.

Website links to assist you: waco-texas.bonfirehub.com/login

RFP 2026-006 Page 2 https://waco-texas.bonfirehub.com/login

BID NUMBER:

DATE:

TIME: CENTRAL

QUICK LINK:

MEETING ID:

DIAL IN NUMBER:

PASS CODE:

ADDITONAL

INFORMATION:

BID NUMBER:

DATE:

TIME: CENTRAL

QUICK LINK:

MEETING ID:

DIAL IN NUMBER:

PASS CODE:

ADDITONAL

INFORMATION:

PRE BID/ PROPOSAL

BID/ PROPOSAL OPENING

ZOOM ACCESS INSTRUCTIONS & ADDITIONAL INFORMATION

Rev. 1

RFP 2026-006 Page 3 https://wacotx.zoomgov.com/j/1601408695?

TABLE OF CONTENTS

Register Interest Form I. Schedule for Solicitation for Competitive Sealed Proposal II. Contact with City of Waco III. Definitions IV. Requested Services V. Request For Proposals – Submission and Award Procedures

Appendices

A. Scope of Services

(1) Detailed Scope of Services and Requirements

(2) Exhibits A, B, and C

B. Contract Requirements

(1) City of Waco General Terms and Conditions

(2) Additional Terms of Services

(3) Insurance & Indemnification Requirements

(4) Sales Tax Information

(5) HB 89 Energy Form

(6) HB 89 Firearms Form

(7) HB 89 Israel Form

(8) HB1295 Information Sheet

(9) Foreign Terrorist Organization Form

(10) Protest Procedure

(11) Registration with the Texas Secretary of State

(12) W-9 Taxpayer Identification Form

(13) Electronic Funds Transfer Authorization (EFT Form)

C. Forms to Complete and Return

(1) Submission of Bid/Proposal and Acknowledgment of Addenda

(2) Business Identification Form

(3) Conflict of Interest Questionnaire (CIQ form)

(4) Disclosure of Relationships with City Council/Officers (City Charter)

(5) HUB Business Certification

(6) Litigation Disclosure

(7) Certification Regarding Debarment

(8) Non-collusion Affidavit

(9) Texas Public Information Act

(10) Drug Free Workplace

RFP 2026-006 Page 4

RFP No. 2026-006 SCADA Support Maintenance, and On-Call Services

Please Register for Notification

REGISTER INTEREST

You have received a copy of the above-described Request document. If you would like to register your interest in this project so that you will receive any future notices or addenda concerning the project, please fill in the information requested below and fax this page to 254-750-8063. You may also scan this page and email to: melaniew@wacotx.gov.

Company/Firm:

Name of Contact Person(s):

Email(s):

Telephone:

Fax:

Mailing Address:

It is your responsibility to complete and return this form to the City. Failure to do so will result in your not receiving notices and addenda related to this project from the City of Waco.

Notices and addenda are posted on the City’s website and can be accessed at: waco-texas.com/bids

City of Waco Purchasing Services Post Office Box 2570

Waco, Texas 76702-2570 Telephone 254 / 750-8060

Fax 254 / 750-8063 waco-texas.com

RFP 2026-006 Page 5 mailto:melaniew@wacotx.gov.

http://www.waco-texas.com/purchasing-rules.asp http://www.waco-texas.com/purchasing-rules.asp http://www.waco-texas.com/

I. SCHEDULE FOR SOLICITATION COMPETITIVE SEALED

PROPOSAL

The proposed schedule of events is tentative and may be modified throughout the selection process at the discretion of the City of Waco.

• Issuance of the RFP February 6, 2026

• Deadline for questions is 5:00 P.M. February 25, 2026

• Proposals due by 2:00 P.M. March 12, 2026

• Proposal Opening at 2:01 P.M. Via Zoom or Dial-in March 12, 2026

• Evaluation of submission March, 2026

• Interviews or Presentations may be conducted March/April, 2026

Tentatively, the final selection decision will be made, and submitters will be notified of award by May 2026. This schedule is subject to change by the City.

II. CONTACT WITH CITY OF WACO

The contact person for this solicitation process is: Melanie Wade, Purchasing Agent who can be reached at:

Email: melaniew@wacotx.gov Telephone: (254) 750-8098 Fax (254) 750-8063

Questions concerning the solicitation can be submitted through the City of Waco’s Bonfire portal at waco-texas.bonfirehub.com/login (preferred) or by email to the contact person listed above.

Official Address (if needed) - City of Waco Purchasing Services

Attn: Melanie Wade, Purchasing Agent 1415 North 4th Street Waco, Texas 76707

Contact someone other than the Purchasing Agent listed above, or his/her designated representative at the City of Waco concerning this solicitation may be grounds for removal from consideration.

Interpretation, modification, corrections, or changes to the solicitation documents will be made by addenda issued by the City of Waco. Addenda will also be made available through the City of Waco’s Bonfire portal at waco-texas.bonfirehub.com/login or the City of Waco Website at waco-texas.com/bids. Interested professional service providers are encouraged to return the Register Interest form on the previous page.

RFP 2026-006 Page 6 mailto:melaniew@wacotx.gov https://waco-texas.bonfirehub.com/login https://www.waco-texas.com/Departments/Purchasing/Open-Bid-Opportunities

III. DEFINITIONS

The following definitions apply to this document and the transaction between the City and the selected submitter unless otherwise designated in the context. Terms, which are singular, may include multiple, where applicable and when in the best interests of the City:

(1) “City” means and refers to the City of Waco, Texas.

(2) “Company” or “Firm” means and refers to any submitter, whether such submitter be a sole proprietor, corporation, company, partnership, company, or any other entity legally defined or recognized under the laws of the State of Texas.

(3) “Proposal” or “Submission” or “Submittal” refers to a response submitted to an RFP.

(4) “Project Review Committee” means a committee established by the City to review and score the submitted Proposals. The Committee may be composed of City of Waco staff, City Councilmembers, or their designees, or other individuals selected to serve on the committee by the City.

(5) “RFP” means and refers to this Request for Proposals.

(6) “Selected submission” means and refers to the submission sent to the City of Waco by the

Selected Firm.

(7) “Selected Firm” means the firm who is selected by the City and to whom the City Council/City

Manager awards a contract for the services or commodities requested in this solicitation.

(8) “Solicitation” means an RFP issued by the City Waco seeking products or services described in the document.

(9) “Submitter” or “Vendor” or “Proposer” or “Contractor” means a firm that submits a response to a solicitation.

(10) “Contract documents” includes the RFP and all of the Appendices attached to the RFP.

(11) “Day” means a calendar day unless otherwise specifically defined.

RFP 2026-006 Page 7

IV. REQUESTED SERVICES/PRODUCTS

A. Scope of Services / Specifications

(1) The City of Waco is soliciting proposals from qualified firms to provide Supervisory Control and Data Acquisition, “SCADA”, support, maintenance, troubleshooting, and small project implementation services for water and wastewater facilities. The selected firm will support mission critical operations, improve reliability, and help maintain a consistent standards-based SCADA environment.

(2) This solicitation is issued using the City’s standard Request for Proposals format, and will be conducted as a Competitive Sealed Proposal process; evaluation will be based on the published criteria and points, and the City may conduct discussions or interviews and may negotiate with the highest ranked proposer.

(3) Scope of services and/or specifications are attached as Appendices.

(4) A digital version of this document can be obtained from the City of Waco’s Bonfire portal at waco-texas.bonfirehub.com/login or the City of Waco Website at waco-texas.com/bids.

B. Terms Conditions & Requirements

In addition to the specifications for the Project, the attached Appendices include the City’s Contract Requirements.

C. Duration of Services

It is anticipated that the selected proposer be awarded a contract to begin May, 2026 (date subject to change). Within the first sixty days of contract start, the selected Contractor shall perform the Phase 0 assessment and deliver the report, risk register, asset inventory, and roadmap in accordance with Exhibit A. Exhibit A defines minimum coverage, required data fields, evidence requirements, risk scoring, and roadmap format. The Phase 0 deliverables are a condition of satisfactory contract performance and are subject to City acceptance. This Phase 0 work may be proposed as a lump sum and will be evaluated as part of the proposal. The agreement is expected to have a maximum duration of 1 year with 4 possible renewals for a 5 year total agreement.

RFP 2026-006 Page 8 http://www.waco-texas.com/bids.asp

D. Reservations by City:

The City of Waco reserves the right to reject any and all submittals. The issuance of this solicitation does not obligate the City to contract for expressed or implied services. The City of Waco will not reimburse proposers for any costs incurred during the preparation or submittal of responses to this solicitation.

(1) Furthermore, the City expressly reserves the right to:

(a) Waive any defect, irregularity, or informality in any submittal or procedure.

(b) Extend the solicitation closing time and date.

(c) Reissue this solicitation in a different form or context.

(d) Procure any item by other allowable means.

(e) Waive minor deviations from specifications, conditions, terms, or provisions of the solicitation, if it is determined that waiver of the minor deviations improves or enhances the City’s business interests under the solicitation; and/or

(f) Extend any contract when most advantageous to the City, as set forth in this solicitation.

(g) Retain all proposals submitted and to use any ideas in a proposal regardless of whether or not that proposal is selected

RFP 2026-006 Page 9

V. REQUEST FOR PROPOSALS – SUBMISSION AND AWARD

PROCEDURES

A. Requirements

(1) Proposals should be kept to the minimum necessary length to explain the proposer’s attributes and pricing. Typed responses are preferred in Times New Roman, Arial or Calibri font.

Responses must be clear and may be subject to disqualification if illegible.

(2) Qualified firms should submit their qualifications through the City of Waco’s Bonfire portal at waco-texas.bonfirehub.com/login. Paper/Physical submissions will still be accepted and should include one (1) electronic copy (CD or Flash Drive) and (1) original and four (4) copies of their statements of qualifications on 8 ½ x 11 paper. These must be received by the date set out above in the Schedule of Solicitation for a submitting firm to be considered:

(a) Cover sheet containing RFP number, project name, and proposer’s name, address, and telephone number.

(b) A brief company history.

(c) See Appendix A for required qualifications and additional submission requirements.

(d) Completed and signed copies of Forms included in Appendix C.

B. Completeness of Submission

(1) Proposers are responsible for examining and being familiar with all specifications, drawings, standard provisions, instructions, and terms and conditions of the solicitation and their responses.

(2) The proposer must attach all required forms with each submission copy. Forms must be signed by a representative of the proposer authorized to bind the proposer contractually. The proposer must include a statement identifying any exceptions to this RFP or declare that there are no exceptions taken to the RFP.

C. Response Date and Location Responses to this solicitation must be received by 2:00 p.m. (Central Time) on March 12, 2026.

The City prefers that vendors use the new Bonfire portal at waco-texas.bonfirehub.com/login, paper submissions will still be received at the address listed below Via Delivery Services or Personal Delivery to:

Attn: Melanie Wade, Purchasing Agent

1415 North 4th Street Waco, Texas 76707

If using U.S. Mail, note that U.S. Mail is initially received at Waco City Hall and then delivered to the office of Purchasing Services by a City courier. That delivery may occur a day or more after being received at Waco City Hall. Allow additional time in advance of the proposal due date for U.S. Mail delivery. If the Purchasing Office has not received the proposal by the stated deadline, the proposal will be returned unopened.

All submissions shall be sent to the attention of the Purchasing Agent in a sealed envelope that is clearly marked on the outside as follows:

RFP 2026-006 Page 10

“RFP 2026-006, SCADA Support, Maintenance, and On-Call Services”

Proposals will be opened at 2:01 P.M. (Central Time) on March 12, 2026

Proposers accept all risk of late delivery bids regardless of instance or fault. A proposal received after the submission deadline will not be considered and will be returned unopened to the submitter.

The City will NOT accept a response submitted by facsimile transmission (fax) or by electronic mail (email).

All submissions and accompanying documentation will become the property of the City.

D. Modification to or Withdrawal of Submission

Submissions cannot be altered or amended after the submission deadline passes. Submissions may be modified prior to the deadline by providing a written notice to the Purchasing contact person at the address previously stated. To modify a submission prior to the submission deadline:

(1) Submit a written notice of the modification WITHOUT revealing the pricing/cost or terms information. The modification should provide the addition, subtraction, or other modifications so that the final pricing/costs or terms will not be revealed to the City until the sealed proposal is opened.

(2) The written modification may be submitted by electronic transmission (fax or email or personal delivery to Purchasing Agent identified earlier in this document. The written modification must be received by the City prior to the closing time.

(3) If the modification is submitted through an electronic transmission (fax or email), the City must receive an original of the modification document signed by the proposer and submitted to a delivery company (UPS, FedEx, etc.) prior to the proposal closing time. If the original of the modification was not submitted to a delivery company prior to the closing time or is not received within three (3) days after the closing time of the bid, consideration will not be given to the modifications provided in the electronic transmission.

A submission may also be withdrawn by providing the notice in person by a representative of the vendor who can provide proof of his authority to act for the proposer. The representative will be required to execute a receipt reflecting the submission is being withdrawn. If a submission is withdrawn before the submission deadline stated herein, the proposer may submit a new sealed proposal provided the new proposal is received prior to the closing date and time deadline stated on page 1. This provision does not change the common law right of a submitter to withdraw a submission due to a material mistake in the submission.

E. Submission Validity Period

A submission responding to this RFP signifies the vendor’s agreement that the submission and the content thereof, are valid for ninety (90) days following the submission deadline unless otherwise agreed to in writing by all parties. The submission may become part of the contract that is negotiated between the City and the successful proposer.

F. Cost to Develop Submission

Costs for developing and assembling submissions in response to this solicitation are entirely the

RFP 2026-006 Page 11 responsibility and obligation of the proposer and shall not be reimbursed in any manner by the City.

G. Evaluation Procedures The proposals will be initially reviewed and evaluated by a Project Review Committee. Each proposal should be as complete and accurate as possible. The City reserves the right to request additional information or clarifications, oral discussions, or presentations in support of the proposal.

H. Vendor Presentation

The evaluation by the Project Review Committee will be presented to the City Manager or Executive staff, who will determine whether proposers may be invited to make a formal presentation of their proposal and/or sit for a panel interview. There is no obligation for the City to host interviews in order to make the final selection.

I. Evaluation Criteria The following criteria will be used to evaluate the submittals (scoring points available):

RFP Scoring Criteria Scoring Points

Available Relevant firm experience and qualifications 15 Technical approach and service delivery model 30 OT cybersecurity maturity and Exhibit B response 15 On-call coverage model and response commitments 15 Phase 0 approach and Exhibit A response 10 Cost and overall value 15

TOTAL AVAILABLE POINTS 100

J. Final Selection

Based on all information reviewed and presentations/interviews (if conducted), the City Manager or Executive staff shall establish the final ranking of the proposals.

(1) During the evaluation process, the City reserves the right, where it may serve the City’s best interest, to request additional information or clarifications from proposers.

K. Contact Award and Execution Following evaluation and interviews (if conducted), the City will rank proposers and may negotiate with the highest ranked proposer. If an agreement cannot be reached, the City may discontinue negotiations and proceed to the next highest ranked proposer.

The final contract must be awarded and approved by the Waco City Council if the amount of the contract will exceed $100,000.00. If the contract is for less than that amount, depending on the amount, the contract may be executed by the City Manager, an Assistant City Manager, department head or director.

The Recipient, in accordance with the provisions of Title VI of the Civil Rights Act of 1964 (78 Stat. 252, 42 U.S.C. §§2000d to 2000d-4) and the Regulations, hereby notifies all bidders that it will affirmatively ensure that any contract entered into pursuant to

RFP 2026-006 Page 12 this advertisement, disadvantaged business enterprises will be afforded full and fair opportunity to submit bids in response to this invitation and will not be discriminated against on the grounds of race, color, or national origin in consideration for an award.

RFP 2026-006 Page 13

APPENDIX A

Scope of Services

(1) Detailed Scope of Services and Requirements

(2) Exhibits A, B, and C

RFP 2026-006 Page 14

SCADA Support, Maintenance, and On Call Services City of Waco, Infrastructure Services Department, Treatment and Compliance Division

1. Purpose

The City of Waco is soliciting proposals from qualified firms to provide Supervisory Control and Data Acquisition, “SCADA”, support, maintenance, troubleshooting, and small project implementation services for water and wastewater facilities. The selected firm will support mission critical operations, improve reliability, and help maintain a consistent standards-based SCADA environment.

2. Background and Standards The City maintains SCADA, controls, instrumentation, and communications systems across treatment plants, pump stations, lift stations, reservoirs, and other remote sites. Work performed under this contract will be expected to align with the City of Waco SCADA, Tagging, Instrumentation, and Controls System Standards Manual, “SCADA TICS Manual”, as well as applicable City information technology policies and safety and electrical codes.

• The City uses ProjectMates workflows for submittals, deviation requests, and review tracking.

Contractor shall use the City’s ProjectMates workflow when required by the City for submittals, deviation requests, and review tracking.

• The City current environment includes Rockwell Automation Programmable Logic Controller, “PLC” and Human-Machine Interface, “HMI”, platforms and EtherNet IP. The Contractor shall support and integrate with the City’s existing standard platforms.

• The City intends to maintain consistent firmware and software versions across facilities to support maintainability and cybersecurity risk management.

NOTE: The SCADA TICS Manual is currently in draft form and may be provided as reference only. The contractually enforceable requirements are those stated in this RFP and incorporated Exhibits, including Exhibit C. The draft manual may be provided as guidance to support standardization.

2.1 – Exhibits Incorporated by Reference

The following exhibits are incorporated by reference into this RFP and will become contractual requirements for the successful proposer. If there is a conflict between the RFP body and an Exhibit, the Exhibit shall govern the subject matter it addresses.

• Exhibit A: SCADA Current State Assessment and Roadmap, Scope, Deliverables, and Acceptance Criteria

• Exhibit B: Operational Technology, “OT” Cybersecurity, Patch, and Vulnerability Management Requirements

• Exhibit C: SCADA TICS Minimum Standards and Draft Manual Reference (minimum enforceable requirements for tagging, programming standards, documentation, change control, and turnover).

3. Scope of Services

3.1 - Phase 0, Current State Assessment and Roadmap Within the first sixty days of contract start, the selected Contractor shall perform the Phase 0 assessment and deliver the report, risk register, asset inventory, and roadmap in accordance with Exhibit A. Exhibit A defines

RFP 2026-006 Page 15 minimum coverage, required data fields, evidence requirements, risk scoring, and roadmap format. The Phase 0 deliverables are a condition of satisfactory contract performance and are subject to City acceptance. This Phase 0 work may be proposed as a lump sum and will be evaluated as part of the proposal.

The City may use the roadmap to execute follow-up task orders under this contract or to support separate procurements, at the City’s discretion.

Contractor shall propose a Phase 0 schedule consistent with Exhibit A; the City’s target is completion within sixty days unless the City approves an adjustment based on facility coverage and site access constraints.

3.2 - Core Support Services

• On call support and troubleshooting for SCADA, controls, instrumentation interfaces, and communications networks.

• PLC, HMI, and SCADA server programming, configuration, database updates, and graphics updates.

• Network support for industrial Ethernet, managed switches, fiber interfaces, licensed radios, and related field communications.

• Support for upgrades and replacements of outdated controllers, servers, workstations, and network devices.

• Support for commissioning activities, including factory acceptance testing and site acceptance testing.

• As built documentation updates and turnover package development.

3.3 – Small Projects and Task Orders The City anticipates issuing task orders or delivery orders for discrete projects, including but not limited to panel upgrades, PLC replacements, HMI and graphics modernization, instrumentation integration, network segmentation improvements, and SCADA historian and reporting enhancements.

4. Cybersecurity and Patch Management Requirements The City’s information technology department will be a required stakeholder for cybersecurity, remote access, and network integration. The Contractor shall coordinate cybersecurity related activities with City Operations, SCADA staff, and City IT, and shall not implement cybersecurity related changes without City approval.

Contractor shall comply with Exhibit B, OT Cybersecurity, Patch, and Vulnerability Management Requirements. Exhibit B is incorporated into the contract and applies to all work performed under this RFP, including Phase 0 services, task orders, on-call support, and emergency response.

The City will maintain custody of administrative credentials and passwords for City owned SCADA and OT platforms, including servers, workstations, network devices, and control system components, consistent with City IT policy. Contractor’s access will be provisioned by the City using approved methods and least privilege.

Contractor shall not create undocumented accounts or change passwords without City approval and shall provide all configuration information necessary for the City to administer and support the environment.

At a minimum, the Contractor shall:

• Maintain and provide an up-to-date OT asset inventory for systems under support, including firmware and software versions, and network addressing, consistent with Exhibit B.

RFP 2026-006 Page 16

• Implement a disciplined patch and firmware management program for OT systems, including a written patch management plan, defined maintenance windows, testing or staging where practical, and documented rollback methods.

• Use City approved secure remote access methods only, and maintain auditable logs for remote sessions, administrative actions, and configuration changes, consistent with Exhibit B.

• Track vendor advisories and vulnerability alerts relevant to the City environment, provide impact assessments, and document mitigation actions or risk acceptance items with compensating controls, consistent with Exhibit B.

• Support backup verification, recovery planning, and cyber event response coordination with City IT and Operations, including restoration to known good configurations, consistent with Exhibit B.

If a patch or firmware update is deferred due to operational constraints, the Contractor shall document the deferral, rationale, compensating controls, and next review date consistent with Exhibit B.

5. Submittals, Documentation, and Acceptance Testing

• Submittals shall include bill of materials, drawings, Input/Output “I/O” lists, network topology, device configurations, IP addressing, tag cross references, and Factory Acceptance Test, “FAT”, and Site Acceptance Test, “SAT”, procedures.

• Provide test documentation that tracks checkout of signals, controls, alarms, historian points, and graphics.

• Provide updated as-built documentation in City requested formats, including AutoCAD, Visio, and Office deliverables as applicable.

• Work order closeout packages shall include an updated change log entry consistent with Exhibit B.

• Upon request, contractor shall provide documentation and system evidence reasonably required to verify compliance with Exhibit B.

6. Qualifications and Staffing

6.1. Minimum Licensing, Certifications, and Training

At a minimum, the prime proposer, and any subcontractor performing SCADA or OT cybersecurity work, shall provide personnel with the following:

• Licensed Professional Engineer, Texas, for electrical, controls, or instrumentation work requiring engineering judgement, including review and sealing of engineering deliverables when required by the City.

• Texas licensed electrician (Master or Journeyman) for any work that requires electrical licensure under applicable law or code.

• Manufacturer platform competence for the City’s standard environment, documented by current training completion or certifications for Rockwell Automation PLC and HMI software used by the City.

• OSHA 10 hour minimum for field personnel performing onsite work at City facilities, or an equivalent safety training program accepted by the City.

• Ability to meet any site specific safety requirements applicable to water and wastewater facilities, including confined space awareness and lockout, tagout compliance when required by the City.

6.2. Minimum Licensing, Certifications, and Training

The City prefers proposers that can provide personnel with one or more of the following:

RFP 2026-006 Page 17

• ISA Certified Automation Professional, CAP, and/or ISA Certified Control Systems Technician, CCST.

• CompTIA Security plus, GIAC, CISSP, or comparable cybersecurity certification for personnel supporting OT cybersecurity requirements under Exhibit B.

• Cisco CCNA or higher, or comparable industrial networking certification for personnel supporting managed switches, routing, segmentation, and related OT communications.

• NICET certification in industrial instrumentation or related controls disciplines for technicians supporting instrumentation and controls interfaces.

• Factory or vendor training credentials for industrial radios, managed switch platforms, and other OT network components used by the City.

6.3. Minimum Licensing, Certifications, and Training

The proposers shall include resumes for key personnel and provide copies, license numbers, or other evidence of the minimum qualifications above. The City may request verification of licensure or certifications at any time during evaluation or contract performance.

7. Proposal Submission Requirements

1. Executive summary and understanding of the City environment.

2. Technical approach, including support model, escalation, and coordination with City IT and operations.

3. On call coverage plan, including:

a. Remote acknowledgement target for critical events

b. Remote triage and stabilization approach

c. Typical onsite response assumptions by time of day, including after hours

d. Local staffing coverage model, subcontractor coverage if applicable

e. Escalation tree and communication methods

4. Cybersecurity and patch management approach, including tools, processes, and example deliverables.

5. Relevant project experience and references.

6. Key staff, roles, and availability.

7. Pricing proposal, including hourly rates, markups if any, and proposed fee structure for on call services.

8. Provide a written response to Exhibit A, including approach, schedule, staffing, sample deliverables outlines, and how you will produce the required inventory fields and risk scoring.

9. Provide a written response to Exhibit B, including your patch and firmware management approach, remote access controls, vulnerability tracking, and reporting cadence.

10. Proposer shall acknowledge receipt of Exhibits A, B, and C and confirm compliance, or list exceptions.

11. Exceptions to terms and conditions, if any.

8. Evaluation Criteria

8.1. Evaluation and Selection

Proposals will be scored using the following criteria:

1. Relevant firm experience and qualifications, including municipal water and wastewater SCADA support, 15 points

RFP 2026-006 Page 18

2. Technical approach and service delivery model, including documentation, change control, testing, and turnover deliverables, and ability to implement and adhere to Exhibit C, SCADA TICS Minimum Standards and Draft Manual Reference, 30 points

3. OT cybersecurity maturity and Exhibit B response, including remote access controls, patch and vulnerability management, and reporting, 15 points

4. On-call coverage model and response commitments, including remote acknowledgement, escalation plan, and onsite response assumptions, 15 points

5. Phase 0 approach and Exhibit A response, including inventory methodology, risk scoring approach, and roadmap format, 10 points

6. Cost and overall value, including hourly rates and any proposed fee structure, 15 points

Note: Criteria 2 and 4 include evaluation of proposer capability to implement and comply with Exhibit C, SCADA TICS Minimum Standards and Draft Manual Reference.

RFP 2026-006 Page 19

Exhibit A, SCADA Current State Assessment and Roadmap Scope and Deliverables

1. Engagement Goals

• Establish a fact-based baseline of current SCADA and OT controls condition across identified facilities

• Identify strengths, deficiencies, and high consequence risks affecting safety, compliance, reliability, and cybersecurity

• Provide an actionable roadmap with prioritized projects, budgetary cost ranges, sequencing, and dependencies

• Define immediate quick wins and near-term stabilization actions that reduce operational risk

2. Scope of Assessment

The City will provide a facilities list and will identify a subset of critical sites and systems for deeper review.

The assessment shall include, at minimum, the following domains.

• SCADA architecture and platform alignment, including servers, HMIs, historians, alarm notification, and licensing posture

• PLC and controller population, including firmware posture, program structure, and standardization alignment

• Network and communications, including segmentation, critical paths, remote access flows, and monitoring coverage

• Backup, restore, and configuration control practices, including change management and documentation completeness

• Alarm management practices, including nuisance alarm conditions and priority alignment

• Cybersecurity posture for OT assets, including patch and vulnerability management, accounts, logs, and compensating controls

• Operational readiness, including response expectations, support workflows, and documentation used by licensed operators

3. Approach and Methods

• Kickoff meeting to confirm scope, facilities, stakeholders, data sources, and constraints

• Document and configuration review, including available drawings, network diagrams, backup repositories, and standards

• Structured interviews with operations, maintenance, SCADA, and IT stakeholders

• Site visits for critical facilities as required by the City

• Non-intrusive technical validation, such as inventory validation, version checks, and configuration baseline review

4. Deliverables

The contractor shall provide deliverables in editable and PDF formats.

RFP 2026-006 Page 20

4.1 – Current State Report

• Executive summary, including what is working well and where the City is exposed

• Findings organized by domain, with evidence and observed impacts

• Risk register with severity, likelihood, consequence, and recommended mitigation

• Standards alignment assessment against City SCADA TICS requirements and City IT requirements

4.2 – Roadmap and Implementation

• Prioritized roadmap with phases, recommended sequence, dependencies, and rationale

• Budgetary cost ranges and effort assumptions for each roadmap item

• Recommended governance and workflow improvements for sustainment, including change control and documentation maintenance

• Recommended measurable targets, such as backup coverage, patch cadence, alarm reduction, and platform standardization

4.3 – Presentation and Workshop

• Stakeholder briefing presentation summarizing findings and roadmap

• Roadmap workshop with operations, SCADA, and IT to validate sequencing and operational constraints

• Final report updates based on City feedback

5. Schedule and Level of Effort

The City prefers an engagement duration of six to ten weeks from notice to proceed, depending on number of sites included. The contractor shall propose a schedule with milestones for kickoff, data collection, draft report, workshop, and final deliverables.

6. Pricing Structure The City recommends lump sum pricing for the assessment engagement with optional adders for additional sites, additional onsite days, or additional deliverable depth. Time and materials pricing may be proposed only if clearly bounded with a not to exceed amount and assumptions.

7. Independence and Use of Roadmap

• The City shall retain rights to use the roadmap and report for future procurements and internal planning.

• If the assessment is performed by the same firm that later performs implementation, the roadmap shall include at least two implementation path options to support City decision making.

RFP 2026-006 Page 21

Exhibit B, OT Cybersecurity, Patch, and Vulnerability Management Requirements

This Exhibit establishes minimum operational technology cybersecurity requirements for contractors performing SCADA support, maintenance, programming, and related services for City facilities. These requirements are intended to align contractor practices with City IT security governance while recognizing the operational constraints of water and wastewater environments.

1. Governance and Coordination

• The contractor shall comply with City information security policies and any City OT standards provided during onboarding.

• The contractor shall coordinate all cybersecurity-related changes with the City OT and IT points of contact prior to implementation.

• The contractor shall participate in periodic cybersecurity coordination meetings as requested by the City, including review of patch status, vulnerabilities, and open risk items.

• The contractor shall promptly notify the City of known insecure, unsupported, or unsafe conditions observed in the City OT or SCADA systems during performance of this contract.

2. Access Control and Remote Access

• Remote access shall be provided only through City approved methods. Contractor shall not install or use ad hoc remote access tools.

• Administrative credentials shall remain under City control. Contractor shall not retain or control City administrative passwords after completion of work.

• Access credentials used to access City OT or SCADA systems shall be unique to the City and shall not be reused across other client environments.

• Contractor shall use least privilege access, unique user accounts, and strong authentication. Multi factor authentication shall be used where supported.

• Remote sessions shall be logged (user identity, time, duration, systems accessed). Logs shall be retained and provided upon request.

• Privileged credentials shall follow City requirements. Shared administrator accounts shall not be used unless explicitly authorized in writing.

3. Asset Inventory and Configuration Baselines

• The contractor shall maintain an inventory for OT assets under support, including device type, make and model, serial number, firmware version, software version, network addressing, and physical location.

• The contractor shall document configuration baselines for systems that are modified, including PLC project versions, HMI project versions, server configuration baselines, and network device configurations as applicable.

• The contractor shall provide inventory exports in an editable format upon request and at least quarterly.

4. Patch Management and Firmware Management

RFP 2026-006 Page 22

The City expects disciplined patch and firmware management for SCADA servers, workstations, network devices, and PLC and controller firmware. The contractor shall implement patching in a manner that preserves operational reliability and safety.

4.1 – Patch Management Plan

• Within thirty days of contract start, the contractor shall submit a written OT patch management plan for City review and approval.

• The plan shall define patch categories, cadence, testing approach, rollback approach, documentation requirements, and approval gates.

• The plan shall define how the contractor will monitor vendor advisories and vulnerability alerts relevant to City OT assets.

4.2 – Testing and Staging

• When practical, patches and firmware updates shall be validated in a staging or test environment prior to production deployment.

• When a staging environment is not available, the contractor shall propose an alternative risk reduction approach, such as limited scope pilots, maintenance window controls, enhanced monitoring, or compensating controls.

4.3 – PLC and Controller Firmware

• PLC and controller firmware updates shall be coordinated with the City and executed only within approved maintenance windows, unless an emergency change is authorized by the City.

• For firmware updates that can impact control behavior, the contractor shall provide a commissioning checklist and functional verification plan, including verification of alarms, interlocks, and permissives.

• The contractor shall document any operational constraints that prevent timely firmware updates and shall propose compensating controls when patching is deferred.

5. Vulnerability Management and Risk Tracking

• The contractor shall track and assess relevant OT vulnerabilities and advisories affecting supported platforms.

• For each material vulnerability, the contractor shall provide an impact assessment, recommended mitigation, and proposed timeline.

• If mitigation is deferred, the contractor shall document a risk acceptance item identifying rationale, interim controls, and next review date.

6. Backups, Recovery, and Cyber-Event Support

Backups and Change Related Backups

• The contractor shall verify that backups exist and are current for systems under support, including PLC projects, HMI projects, SCADA servers, alarm systems, and network device configurations as applicable.

• For any contractor executed change that affects operations, cybersecurity posture, or recoverability, the contractor shall capture a pre-change backup immediately prior to work and a post-change backup upon completion and confirm readability consistent with City direction.

• The contractor shall document backup locations, timestamps, and restore verification steps in the work order closeout package.

RFP 2026-006 Page 23

OT Cyber Event Support, Remote Triage and Onsite Response

• The contractor shall provide remote acknowledgement and triage for OT cybersecurity events, including suspected ransomware, malware, unauthorized access, or loss of visibility/control. Remote acknowledgement shall occur within one hour of notification, 24 hours per day, 7-days per week.

• The contractor shall support containment and restoration activities in coordination with City IT and Operations. If onsite support is required, the contractor shall provide onsite response as soon as practicable and consistent with the proposer’s stated local coverage model.

• The contractor shall propose a written escalation and response plan, including after-hour contacts, remote access method, and the boundary between contractor actions and City IT actions.

7. Training and Personnel Controls

• Contractor personnel with City OT access shall complete City required cybersecurity and OT access training prior to system access.

• Contractor shall maintain a current list of authorized personnel and notify the City promptly of staffing changes.

• Subcontractors shall comply with the same requirements.

8. Reporting and Deliverables

At a minimum, the contractor shall provide the following deliverables:

• OT asset inventory updates, at least quarterly

• Patch status report, at least quarterly (completed, pending, deferred, rationale)

• Vulnerability reports and any deferred mitigation items shall be provided to City IT, Infrastructure Services, and the City Chief Information Security Officer (CISO). High, critical, or actively exploited OT vulnerabilities shall be escalated to the same parties.

• Change log entries for all material changes to the City SCADA and OT environment, including cybersecurity related changes (accounts, access, patches, firmware) and operational or configuration changes (PLC logic, HMI graphics, alarm settings, historian configuration, network device configurations).

• Incident support after action notes when the contractor supports a cyber event response

9. Verification and Evidence The contractor shall provide evidence of compliance with the OT cybersecurity requirements in this Exhibit upon request, including configurations, logs, inventories, change records, and reports reasonably required by the City for verification. Evidence shall be provided within a timeframe specified by the City based on operational needs and sensitivity of the request, and shall be provided in a format reasonably usable for verification.

RFP 2026-006 Page 24

Exhibit C, SCADA TICS Manual

1. Purpose and Applicability This Exhibit establishes the minimum SCADA, controls, instrumentation, and OT documentation and implementation standards that are contractually enforceable under this RFP. These requirements apply to all work performed under this contract, including support activities, task orders, emergency response, and the Phase 0 assessment where applicable.

2. Standards Governance, Compliance, and Ownership

2.1. Mandatory Compliance

Unless the City explicitly waives a requirement in writing for a specific task, all applicable provisions of this RFP and its incorporated Exhibits shall be satisfied.

2.2. Standards application in upgrades

For upgrades at existing facilities, the Contractor shall apply current City standards whenever practical, and shall use City standard programming templates, reusable routines, and standard approaches where provided.

2.3. Deviation management

If a deviation from City standards is necessary due to constraints (space limitations, process constraints, safety constraints, or similar), the Contractor shall submit a deviation request promptly after the need is identified and before performing the affected work. The request shall include justification, risks, and the proposed alternative. Deviations are not approved unless authorized in writing by the City. Unapproved deviations, and any required rework to meet standards, are the responsibility of the Contractor.

2.4. Revision and standards evolution

The City anticipates continued development of the SCADA TICS Manual and related standards. The Contractor shall participate in standards refinement as requested by the City. City updates that materially change scope, or require retrofit of existing systems, will be handled through task orders or written City direction.

2.5. Project workflow

When required by the City, submittals, deviation requests, and review tracking shall be executed through the City’s ProjectMates workflow.

3. Platform and Development Standards

3.1. Controller and HMI platform alignment

The City’s current environment includes Rockwell Automation PLC and HMI platforms and EtherNet IP communications. The Contractor shall support and integrate with the City’s existing standard platforms.

3.2. Programming environment and practices

Controller programming shall use the City approved Rockwell programming environment, and shall follow a structured approach that supports reuse, consistency, and maintainability. The Contractor shall leverage modern controller features where appropriate, including IEC 61131 language capability, tag aliasing, symbolic tag naming, user defined data structures, arrays, and add on instructions.

RFP 2026-006 Page 25

3.3. Standardization and reuse

The Contractor shall use City standard code patterns, templates, and routines when provided and applicable. Where City standard routines do not exist for a required function, the Contractor shall follow a consistent structure and submit a proposed approach for City review.

4. Tagging and Naming Minimum Standards

4.1. Unique tags and cross-reference

Every piece of equipment, device, signal, and SCADA generated data point created or modified under this contract shall have a unique tag consistent with City conventions. Tagging shall support cross referencing between field devices, drawings, PLC code, HMI graphics, historian points, alarms, and work management records.

4.2. Tag structure, minimum convention

The City tagging convention uses multiple fragments to convey facility, device type, unit process or loop, and signal designation. The City will provide the approved facility codes and device and signal code lists as controlled reference data. The Contractor shall use the City provided code lists and shall not invent new codes without City approval.

4.3. Tag visibility on drawings

For drawings where all devices share a common facility and process context, the City may allow omission of the leading fragment on certain drawings if the drawing includes a clear note identifying the common portion. Full tag fragments shall never be omitted in SCADA database tags or physical tagging.

4.4. Tag descriptions

Tag descriptions shall follow a consistent structure that clearly identifies the site, equipment or instrument, and function. Descriptions shall be meaningful to licensed operators and maintenance staff.

4.5. Integration intent

Tagging produced under this contract shall be suitable for use in the City’s asset and maintenance systems, and for correlation with GIS where applicable. The City will define the system of record expectations during onboarding.

5. Documentation, Submittals, and Turnover Minimum Standards

5.1. Documentation required for material change

For work that modifies PLC logic, HMI graphics, SCADA configuration, alarms, historian configuration, or network configurations, the Contractor shall provide updated documentation appropriate to the change.

At a minimum, this includes the applicable subset of the following: I/O list updates, tag list updates, alarm list updates, network topology or addressing updates, and as built redlines.

5.2. Deliverable formats

Deliverables shall be provided in editable format and PDF. Source files shall be provided for PLC and HMI applications and for configuration files where…