FY27 Alton - Scope - BAS Generator IT Security Service~1.docx
DOCX document 31 KB Posted
- Attached to
- DBHR AMHC SP Building Automation System (BAS)
- Solicitation number
- 27-444DHS-MENTH-B-52351
- Issued by
- Madison County, Illinois
About this file
This is a Scope of Work document for the Alton Mental Health Center (AMHC), a facility operated by the Illinois Department of Behavioral Health and Recovery (DBHR), located in Alton, Illinois. The procurement (Requisition #27-444DHS-MENTH-B-52351) seeks a qualified vendor to provide IT-side support and cybersecurity services for the Building Automation System (BAS) and generator for a one-year term from July 1, 2026, through June 30, 2027. The scope is limited exclusively to computer server, software platform stability, cybersecurity, patching, and data protection functions, explicitly excluding HVAC programming, mechanical system control tuning, field device work, and controller replacements. The vendor must comply with applicable Illinois Department of Innovation & Technology (DoIT) security requirements and state background screening standards for all assigned personnel.
The vendor's primary responsibilities include applying OS and security patches quarterly, maintaining antivirus and anti-malware protection, conducting automated daily and weekly backup procedures with offsite and onsite storage, implementing access control and user account management with multi-factor authentication preference, and providing standard support response within 24 hours and critical outage response within 4 hours. Required deliverables include quarterly server health and update reports, quarterly backup verification documentation, annual cybersecurity posture reports, and semi-annual access and user audit lists. Vendors must demonstrate the ability to meet state IT security standards and comply with DoIT cybersecurity requirements, with detailed specifications to be incorporated into the contract upon award. No pricing information, set-asides, incumbent vendor details, or specific funding amounts are included in this scope document.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Information and Technology Standard Terms and Conditions_v26.pdf | ||
| Std Terms and Conditions~6.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Requisition # 27-444DHS-MENTH-B-52351
Building Automation System (BAS) – IT Security & Server Support Specification
1. Purpose & Scope This procurement is for IT-side support of the Building Automation System (BAS), and generator focused solely on computer/server, software platform stability, cybersecurity, patching, and data protection. The vendor will not be responsible for HVAC programming, field devices, mechanical system control tuning, or controller replacements.
Objective: maintain secure & reliable BAS operation environment while preventing cyber intrusion risks.
2. Systems Covered Under Contract
• BAS server/host workstation
• BAS supervisory software & licensing maintenance
• Windows/OS environment & update compliance
• Antivirus/anti-malware protection
• Database backup and restoration readiness
• Virtual machine hosting (if applicable)
• Network firewall/security configuration for BAS
• User accounts, credentials, and permission access
3. Vendor Responsibilities A. Routine Maintenance:
- Apply OS/security patches quarterly
- Maintain BAS software updates & version control
- Conduct malware scans & prevent threats
- Monitor CPU, memory, storage utilization
B. Cybersecurity Requirements:
- Maintain firewall & network isolation per best practice
- Review cybersecurity configuration annually
- Monitor for intrusion or unauthorized connection attempts
C. Backup & Disaster Recovery:
- Maintain automated daily/weekly scheduled backups
- Offsite + onsite storage required
- Verify recovery capability quarterly
D. Access Control Management:
- Create/disable user accounts when authorized
- Maintain password policies, MFA preferred
E. Response Requirements:
- Standard support response within 24 hours
- Critical outage response within 4 hours
4. Required Deliverables to Owner
• Quarterly server health & update report
• Quarterly backup verification documentation
• Annual cybersecurity posture report
• Semi-annual access/user audit list
5. Explicit Contract Exclusions ✘ No mechanical/HVAC controls troubleshooting ✘ No programming or sequence modifications ✘ No VAV/sensor/field device work ✘ No installation or retrofit labor
6. Vendor Minimum Qualifications
· Ability to meet facility/state IT security standards
· Vendors must comply with applicable Illinois Department of Innovation & Technology (DoIT) security requirements, including but not limited to: Detailed requirements will be incorporated into the contract and/or provided upon award. Vendors must attest to their ability to comply.
· Personnel must meet background screening requirements
· All assigned personnel must pass required State background checks prior to site and network access.
7. Contract Term One (1) year term FY27, 07/01/2026-06/30/2027.
File details come from the government source that posted it. Updated .