ITN_39403_Cyber_Assessment_Final.pdf

ITN 39403

- 1 -

THE GOVERNING BOARD OF THE

ST. JOHNS RIVER WATER MANAGEMENT DISTRICT

CYBERSECURITY ASSESSMENT INVITATION TO NEGOTIATE 39403

The Governing Board of the St. Johns River Water Management District (the “District”), requests that interested parties respond to the solicitation below by 2:00 p.m., March 12, 2024. Further information is available through DemandStar at Demandstar.com [(800) 711-1712], Vendor Registry at Vendorregistry.com, Central Bidding at centralauctionhouse.com, or the District’s website at sjrwmd.com. Solicitation packages may be obtained from DemandStar, Vendor Registry, Central Bidding, or the District by calling or emailing Kendall Matott, Contracts Manager, at 386-312-2324 or kmatott@sjrwmd.com. Responses will be opened in the Procurement Conference Room, Administration Building, Palatka Headquarters, 4049 Reid Street, Palatka, Florida 32177-2571.

The District is seeking the services of an experienced consultancy to assess the effectiveness of the agency’s IT security and data governance practices and make recommendations for improvement, including alignment with the NIST Cybersecurity Framework (CSF) as prescribed for state agencies and local governments in sections 282.318, Florida Statutes and NIST FIPS 199.

Before commencing any Work, as defined herein, all persons performing said Work, whether on or off District property, shall be required to sign a Confidentiality Agreement and may be required to undergo certain security checks, pursuant to Florida law.

Non-Mandatory Pre-Submittal Conference

A VIRTUAL NON-MANDATORY PRE-SUBMITTAL CONFERENCE IS SCHEDULED FOR

11:00 A.M., FEBRUARY 22, 2024.

Virtual Meeting Instructions: Please note a presentation may be given, please join by computer for full participation capabilities.

For Microsoft Teams or Skype:

Meeting ID: 217 745 683 810 Passcode: GEN5pw Link: Click here to join the meeting

Or audio only:

Conference phone number 1-386-256-1151 Meeting ID: 260 631 712# https://teams.microsoft.com/l/meetup-join/19%3ameeting_YzM2NmQ2YzQtYjBhZC00OTc4LWFiMDgtNGM4MzY2ZTI5ZDI2%40thread.v2/0?context=%7b%22Tid%22%3a%22b0c8375f-daa7-40b9-a01b-690d8d3723b9%22%2c%22Oid%22%3a%223576c7e9-9bce-4636-9019-6bd94f4b230c%22%7d

- 2 -

The District will conduct ITN process as follows:

Date Description February 22, 2024, 11:00 a.m. Pre-Submittal Conference March 12, 2024, 2:00 p.m. ITN Submittals due March 17, 2024, 10:00 a.m. Review the evaluation criteria and responsibilities of the evaluators March 27-28, 2024, 11:00 a.m. Evaluation committee meeting to discuss, and rank proposals to establish short list to present oral presentations and discuss negotiation strategies. (District HQ, 4049 Reid St, Palatka, FL 32177, Admin Bldg, Conf Rm 147)

April 9-10, 2024 Oral Presentations and hold negotiations with short-listed Respondents. All aspects of the proposal, agreement, and price are subject to negotiation.

April 11, 2024, 10:00 a.m. Evaluation committee meeting to discuss oral presentations and finalize supplemental instructions

April 12, 2024 Send supplemental instructions April 24, 2024, 8:00 a.m. Best and Final Offers due April 24, 2024, 2:00 p.m. Evaluation committee meeting to review and discuss Best and Final Offers. Once all offers are considered and the Evaluation committee has reached a decision, all Respondents will be notified in writing of the Evaluation Committee’s intended recommendation to the Governing Board for consideration.

May 14, 2024, 10:00 a.m. District Governing Board consideration to approve the Evaluation committee’s recommendation

Once all offers are considered and the Evaluation Committee has reached a decision, all Respondents will be notified in writing of the Evaluation Committee’s intended recommendation to the Governing Board for consideration.

Special accommodations for disabilities may be requested through Kendall Matott, Contracts Manager, at 386- 312-2324 or by calling (800) 955-8771 (TTY), at least five business days before the date needed.

- 3 -

INSTRUCTIONS TO RESPONDENTS ......................................................................................................... - 4 -

1. DEFINITIONS ........................................................................................................................................ - 4 -

2. CONTRACT ADMINISTRATION ........................................................................................................ - 4 -

3. WHERE TO SUBMIT DIGITAL PROPOSAL ...................................................................................... - 4 -

4. OPENING OF PROPOSALS .................................................................................................................. - 5 -

5. ELECTRONIC SUBMISSION AND PREPARATION AND ORGANIZATION OF THE

SUBMITTAL…………….. .................................................................................................................... - 5 -

6. INQUIRIES AND ADDENDA ............................................................................................................... - 6 -

7. BUDGET................................................................................................................................................. - 7 -

8. MINIMUM QUALIFICATIONS ............................................................................................................ - 7 -

9. PROPOSAL GUARANTY ..................................................................................................................... - 7 -

10. SUBCONTRACTS ................................................................................................................................. - 7 -

11. SIGNATURE AND CERTIFICATION REQUIREMENTS .................................................................. - 8 -

12. DISQUALIFICATION OF RESPONDENTS ........................................................................................ - 8 -

13. REJECTION OF PROPOSAL ................................................................................................................ - 8 -

14. WITHDRAWAL OF PROPOSAL .......................................................................................................... - 8 -

15. EVALUATION AND AWARD PROCEDURES ................................................................................... - 9 -

16. EVALUATION CRITERIA .................................................................................................................. - 10 -

17. EXECUTION OF AGREEMENT ......................................................................................................... - 11 -

18. EXAMINATION OF AGREEMENT DOCUMENTS AND WORK AREA ....................................... - 11 -

19. DIVERSITY OPPORTUNITY ............................................................................................................. - 12 -

20. FLORIDA SALES TAX ....................................................................................................................... - 12 -

21. PUBLIC ENTITY CRIMES/DISCRIMINATORY VENDORS .......................................................... - 12 -

22. USE BY OTHER FLORIDA GOVERNMENTAL ENTITIES ............................................................ - 12 -

23. NOTICES AND SERVICES THEREOF .............................................................................................. - 12 -

24. PROHIBITION AGAINST CONSIDERING SOCIAL, POLITICAL, OR IDEOLOGICAL INTERESTS

IN GOVERNMENT CONTRACTING – F.S. 287.05701 …………………………........................... - 13 -

25. PROTEST PROCEDURES ................................................................................................................... - 13 -

FORMS ............................................................................................................................................................ - 14 -

PROPOSAL FORM .......................................................................................................................................... - 14 - COST SCHEDULE ........................................................................................................................................... - 15 - CERTIFICATE AS TO CORPORATION ........................................................................................................ - 16 -

AFFIDAVIT AS TO NON-COLLUSION AND CERTIFICATION OF MATERIAL CONFORMANCE WITH

SPECIFICATIONS ........................................................................................................................................... - 17 -

QUALIFICATIONS — GENERAL FORM …………………………………………………………………- 18 -

QUALIFICATIONS — SIMILAR PROJECTS / CLIENT REFERENCES ..................................................... - 19 - PROPOSED SUBCONSULTANTS ................................................................................................................. - 22 - DRUG-FREE WORKPLACE FORM ............................................................................................................... - 23 - NO RESPONSE FORM .................................................................................................................................... - 24 -

SAMPLE AGREEMENT ............................................................................................................................... - 25 -

ATTACHMENT A — STATEMENT OF WORK ...................................................................................... - 40 -

ATTACHMENT B — INSURANCE REQUIREMENTS ........................................................................... - 47 -

ATTACHMENT C — DISTRICT’S SUPPLEMENTAL INSTRUCTIONS (SAMPLE) ........................ - 48 -

- 4 -

INSTRUCTIONS TO RESPONDENTS

1. DEFINITIONS

The definitions of capitalized terms used in this solicitation that are not otherwise defined herein can be found in the sample contract document (the “Agreement”) that is at the end of these instructions.

2. CONTRACT ADMINISTRATION

All inquiries related to this solicitation may only be directed to the Procurement Specialist:

Kendall Matott, Contracts Manager Phone: 386-312-2324 Email: kmatott@sjrwmd.com

Between the release of this solicitation and the posting of the notice of intended decision, Respondents to this solicitation or persons acting on their behalf may not contact any employee or officer of the District concerning any aspect of this solicitation, except the procurement employee listed above. Violation of this provision is grounds for rejecting a response.

3. WHERE TO SUBMIT DIGITAL PROPOSAL

Respondent must submit its Proposal in a digital/electronic format (no paper copies) either by:

(1) uploading to Demandstar directly at www.demandstar.com , or

(2) delivering all files on a single pin/thumb/jump drive either by mail or hand delivery in a sealed envelope labeled as follows:

SEALED PROPOSAL – DO NOT OPEN

Respondent’s Name:

Invitation to Negotiate: 39403 Opening Time: 2:00 p.m.

Opening Date: March 12, 2024

Kendall Matott, Contracts Manager St. Johns River Water Management District District Headquarters 4049 Reid Street Palatka, FL 32177

DO NOT SUBMIT YOUR BID BY EMAIL — THIS WILL RESULT IN THE BID BEING REJECTED

AS NONRESPONSIVE.

Please note that the United States Postal Service does not deliver regular mail or express mail to the above address. The District’s experience is that Federal Express and United Parcel Service will.

http://www.demandstar.com/

- 5 -

4. OPENING OF PROPOSALS

Respondents or their authorized agents are invited to attend the opening of the Proposals at the following time and place:

2:00 p.m., March 12, 2024 St. Johns River Water Management District Headquarters 4049 Reid Street, Palatka, Florida 32177-2571

The Florida Public Records Act, §119.071(1)(b), Fla. Stat., exempts sealed Proposals from inspection and copying until such time as the District provides notice of an intended decision pursuant to §120.57(3)(a), Fla. Stat., or until 30 days after opening of bids, proposals, submittals, or final replies, whichever is earlier.

This exemption is not waived by the public opening of the Proposals.

Unless otherwise exempt, Respondent’s Proposal is a public record subject to disclosure upon expiration of the above exemption period. If any information submitted with the Proposal is a trade secret as defined in §812.081, Fla. Stat., and exempt from disclosure pursuant to §815.04, Fla. Stat., Respondent must clearly identify any such material as “CONFIDENTIAL TRADE SECRET” in its Proposal and explain the basis for such exemption. The District reserves the right, in its sole judgment and discretion, to reject a Proposal for excessive or unwarranted assertion of trade secret confidentiality and return the Proposal to Respondent.

5. ELECTRONIC SUBMISSION AND PREPARATION AND ORGANIZATION OF THE

SUBMITTAL

Respondent must submit its Proposal in an electronic format as directed in paragraph 3, above, or the Proposal may be deemed non-responsive.

Regardless of which method Respondents elect to submit their Proposals, Respondents must comply with the following instructions:

a. All blank spaces on the bid documents must be typewritten or legibly printed in ink. In the event you decline to submit a Proposal, the District would appreciate submittal of the “No Response Form” provided at the end of the “FORMS” section to describe the reason for not submitting a Proposal.

b. Respondent must specify the cost for each item described in the Agreement (the “Work”) in figures as indicated by the spaces provided on the Price Proposal — Cost Schedule.

c. The District recommends that Respondents confirm their Submittal will open correctly on a non-company owned computer. Any electronic submittal received by the District that does not open on a District-owned computer is subject to rejection as a defective response.

d. Do NOT password protect the pin/flash/thumb drive or electronically submitted files.

e. The file naming conventions for the Proposal must clearly identify specific information, such as the solicitation number and the respondent’s name (Example: ITN 39403, ABC Venture LLC. 01-19-2024).

All of the forms and questionnaires in the Invitation to Negotiate package are available upon request in Microsoft® Word and Excel to aid the Respondent in submitting its Proposal in electronic format.

A RESPONDENT’S PROPOSAL MAY BE REJECTED AS NON-RESPONSIVE FOR (1) FAILING

TO COMPLETE ALL FORMS AND QUESTIONNAIRES; (2) FAILING TO PROVIDE ALL

REQUIRED MATERIALS; OR (3) OTHERWISE FAILING TO COMPLY WITH

INSTRUCTIONS FOR PREPARATION AND ORGANIZATION OF THE SUBMITTAL.

It is the Respondent’s responsibility to include information in its Response to present all relevant qualifications and other materials. The Response, however, should not contain standard marketing or other general materials. The requirements set forth below represent the minimum content for the Response. It is Respondent’s responsibility to modify such materials so that only directly relevant information is included in the Response.

- 6 -

Respondent must use a naming convention similar to the example shown below for each file folder:

Example: “ITN 39403_Proposer Name_Tab_1”

Tab 1 — Organizational Profile - Respondent’s and Subconsultants’ overall background, qualifications, capabilities, experience, and availability to conduct work as presented in the Statement of Work (Complete all District-provided forms)

1. Description of the Respondent firm and their overall qualifications and capabilities

2. Organizational structure and specific names, functions, and availability of key personnel (include resumes)

3. Organizations experience with penetration testing

4. Required Administrative Forms:

a. Proposal Form

b. Certificate as to Corporation Form

c. Affidavit as to Non-Collusion and Certification of Material Conformance with Specifications

d. Qualifications — General Form

e. Proposed Subconsultants

f. Drug-Free Workplace Form – required only in the event of a tie

Tab 2 — Qualification References – provide three references from projects successfully completed within the past three years immediately preceding that date of receipt of submittals. At least one of the three similar projects must have been for a public sector entity in the United States.

1. Qualifications — Similar projects / Client references

Tab 3 — Technical qualifications and experience of key personnel in cybersecurity assessment projects emphasis on projects successfully completed within the last 3 years

2. Staffing functions, names, qualifications, certifications, and resumes

3. Allocation of staff assigned to the Project

Tab 4 — Technical Merit (Statement of Work)

1. Respondent Proposal (include phased Project plan with incremental milestones and deliverables)

Tab 5 — Cost Effectiveness

1. Cost Schedule Form

The Respondent is encouraged to include as much pertinent data and information under each section as necessary to ensure proper evaluation of the qualifications. Each section shall be evaluated separately on its own merit.

If you need assistance or have any questions about the format, please email or call Kendall Matott at kmatott@sjrwmd.com or 386-312-2324.

6. INQUIRIES AND ADDENDA

District staff are not authorized to orally interpret the meaning of the specifications or other Agreement documents, or correct any apparent ambiguity, inconsistency, or error therein. In order to be binding upon the District, the interpretation or correction must be given by the Procurement Specialist and must be in writing. The Procurement Specialist may orally explain the District’s procedures and assist Respondents in referring to any applicable provision in the Invitation to Negotiate documents, but the Respondent is

- 7 -ultimately responsible for submitting the Proposal in the appropriate form and in accordance with written procedures.

Every request for a written interpretation or correction must be received at least nine days prior to opening of Proposals in order to be considered. Requests may be submitted by email at kmatott@sjrwmd.com.

Interpretations, corrections, and supplemental instructions will be communicated by written addenda to this solicitation posted on DemandStar and Vendor Registry to all prospective Respondents (at the respective addresses furnished for such purposes) no later than five days before the opening of Proposals.

Submission of a Proposal constitutes acknowledgment of receipt of all addenda. Proposals will be construed as though all addenda had been received. Failure of the Respondent to receive any addenda does not relieve Respondent from any and all obligations under the Proposal, as submitted. All addenda become part of the Agreement.

7. BUDGET

The estimated budget for the Work is $50,000 and is an estimate only and does not limit the District in awarding the Agreement. Respondents are cautioned to not make any assumptions from the budget estimate about the total funds available for the Work. The District retains the right to adjust the estimate in awarding the Agreement. The District also reserves the right to reject all Proposals if subsequent negotiations with qualified Respondents result in costs over this estimated budget amount. In addition, the District reserves the right to increase, decrease, or delete any class, item, or part of the Work in order to reduce costs for any reason. The District may discuss alternatives for reducing the cost of the Work with Respondents and make such modifications as it determines to be in its best interest.

8. MINIMUM QUALIFICATIONS

Respondent must use and complete the “Qualification” forms (General, Similar Projects, and Client References) provided in these documents toward documenting its minimum qualifications. If Respondent fails to include these forms and the documentation requested below in the ITN process, Respondent’s Proposal may be considered non-responsive.

a. Minimum five years of experience in cybersecurity consulting

b. Must have successfully completed three similar projects in the past three years

c. Assigned project lead must hold certification(s) in information security. Please provide project lead’s name and certifications held.

d. Respondent must conduct the Work within the United States of America

Irrespective of the minimum qualifications stated above, the District may make such investigations as it deems necessary to determine the ability of the Respondent to perform the Work. The District reserves the right to reject any Proposal if the evidence submitted by such Respondent and/or the District’s independent investigation of such Respondent fails to satisfy the District that such Respondent is properly qualified to carry out the obligations of the Agreement and complete the Work in a manner acceptable to the District within the time period specified.

9. PROPOSAL GUARANTY

For purposes of this solicitation proposal guaranty is not required.

10. SUBCONTRACTS

Respondent must submit with its Proposal a list of all known subconsultants who will participate in more than ten percent of the Work on the attached “Proposed Subconsultants” form. Acceptance of the Proposal does not constitute approval of the subconsultants identified with the Proposal.

- 8 -

11. SIGNATURE AND CERTIFICATION REQUIREMENTS

An individual submitting a Proposal must sign his/her name therein and state his/her address and the name and address of every other person interested in the Proposal as principal. If a firm or partnership submits the Proposal, state the name and address of each member of the firm or partnership. If a corporation submits the Proposal, an authorized officer or agent must sign the Proposal, subscribing the name of the corporation with his or her own name and affixing the corporate seal. Such officer or agent must also provide the name of the state under which the corporation is chartered, and the names and business addresses of the President, Secretary, and Treasurer. Corporations chartered in states other than Florida must submit evidence of registration with the Florida Secretary of State for doing business in the State of Florida. Respondent must certify that all persons or entities having an interest as principal in the Proposal or in substantial performance of the Work have been identified in the Proposal forms.

12. DISQUALIFICATION OF RESPONDENTS

Any of the following causes will be considered as sufficient grounds for disqualification of a Respondent and rejection of the Proposal:

a. Contacting a District employee or officer other than the procurement employee named in this solicitation about any aspect of this solicitation before the notice of intended decision is posted.

b. Submission of more than one Proposal for the same subject matter by an individual, firm, partnership, or corporation under the same or different names;

c. Evidence of collusion among Respondents;

d. Submission of materially false information;

e. Information gained through checking of references or other sources which indicates that Respondent may not successfully perform the Work;

f. Respondent is failing to adequately perform on any existing contract with the District;

g. Respondent has defaulted on a previous contract with the District;

h. The evidence submitted by Respondent, or the District’s investigation of Respondent, fails to satisfy the

District that Respondent is properly qualified to carry out the obligations of the Agreement in a manner acceptable to the District and within the time period specified;

i. Any other cause that is sufficient to raise doubt regarding the ability of a Respondent to perform the Work in a manner that meets the District’s objectives for the Work.

13. REJECTION OF PROPOSAL

Proposals must be delivered to the specified location and received before the Proposal opening in order to be considered. Untimely Proposals will be returned to the Respondent unopened. Proposals will be considered irregular and may be rejected if they show material omissions, alterations of form, additions not called for, conditions, limitations, or other material irregularities. The District may consider incomplete any Proposal not prepared and submitted in accordance with the provisions specified herein and reserves the right to waive any minor deviations or irregularities in an otherwise valid Proposal.

The District reserves the right to reject any and all Proposals and cancel this invitation to negotiate when it determines, in its sole judgment and discretion, that it is not in its best interest to award the agreement.

14. WITHDRAWAL OF PROPOSAL

Respondent may withdraw its Proposal if it submits such a written request to the District prior to the designated date and hour of opening of Proposals. Respondent may be permitted to withdraw its Proposal no later than 72 hours after the Proposal opening for good cause, as determined by the District in its sole judgment and discretion.

- 9 -

15. EVALUATION AND AWARD PROCEDURES

a. Proposals will be evaluated by a staff evaluation committee based upon the criteria and weighting set forth in “EVALUATION CRITERIA” to determine the shortlist of respondents for the oral presentations and negotiation phase of the solicitation process, as well as the final rankings, inclusive of the Best-and-Final offers. The committee members will meet at District headquarters or other location as appropriate to discuss the Proposals and their individual evaluations. The committee will meet to evaluate and rank the Proposals in the location(s), time(s) and date(s), stated at the beginning of this Invitation to Negotiate package. Each committee member completes an electronic evaluation form, from which the overall ranking of Proposals is compiled. Evaluation forms may be submitted at or subsequent to the evaluation committee meeting.

b. Short-listed Respondents may be invited to present and negotiate on their proposals. Following negotiations, each Respondent will submit Best-and-Final Offers (“BAFO”) to the District. After receiving BAFOs, Proposals will be re-evaluated using the same criteria and methodology used to score the initial proposals.

c. Section 286.0113, Fla. Stat., exempts from being open to the public, any portion of a meeting at which:

(1) a negotiation with a Respondent is conducted pursuant to a competitive solicitation; (2) a Respondent makes an oral presentation as part of a competitive solicitation; (3) a Respondent answers questions as part of a competitive solicitation; or (4) negotiation strategies are discussed. Also, recordings of, and any records presented at, the exempt meeting are exempt from §119.07(1) and §24(a), Art. I of the State Constitution (Public Records) until such time as the District provides notice of an intended decision or until 30 days after opening the bids, proposals, submittals, or final replies, whichever occurs earlier. A complete recording shall be made of any portion of an exempt meeting. No portion of the exempt meeting may be held off the record.

d. Pursuant to §286.0113 Fla. Stat., if the District rejects all Proposals and concurrently provides notice of its intent to reissue the competitive solicitation, the recording and any records presented at any exempt meeting shall remain exempt from §119.07(1) and §24(a), Art. I of the State Constitution (Public Records) until such time as the District provides notice of an intended decision concerning the reissued competitive solicitation or until the District withdraws the reissued competitive solicitation. A recording and any records presented at an exempt meeting are not exempt for longer than 12 months after the initial District notice rejecting all Proposals.

e. Following the evaluation process, the District will submit a recommendation to the Governing Board for approval, except for those instances in which the authority to approve and execute the Agreement has been delegated by the Governing Board to the Executive Director, or designee. All Respondents will be notified in writing of the evaluation committee’s final ranking of Submittals.

f. The Agreement will be awarded to the Respondent having the highest ranked Proposal, which successfully concludes negotiations with the District (the “Successful Respondent”). The Agreement may be modified based on the District’s acceptance of any alternatives listed in the Proposal that the District deems in its best interest.

g. If two or more Proposals are equal in all respects, the Agreement will be awarded as follows: (1) to the Respondent that certifies compliance with §287.087, Fla. Stat., via the Drug-Free Workplace Form;

(2) to a Respondent university in the State University System pursuant to §373.63, Fla. Stat.; or (3) by lot.

h. In the event the Successful Respondent fails to enter into the Agreement or the Agreement with said Respondent is terminated within 90 days of the effective date, the District reserves the right to award the Agreement to the next highest ranked Respondent, if available.

i. All Respondents will be notified of the District’s intent to award or decision to award the Agreement.

For the purpose of filing a protest under §120.57(3), Fla. Stat., the time period will commence as provided in “NOTICES AND SERVICES THEREOF.”

- 10 -

16. EVALUATION CRITERIA

The staff evaluation committee will evaluate the Proposal using the evaluation criteria on the subsequent page. Failure by Respondent to include the required information may result in the Proposal being considered non-responsive or may receive a correspondingly low score pursuant to the evaluation rating scale.

The District will use the following scoring matrices to determine the shortlist of respondents for the oral presentations and negotiation phase of the solicitation process, as well as the final rankings inclusive of the Best-and-Final Offers.

1. Determine the Shortlist of Respondents – Initial Ranking

a. The committee will use the total weighted score for Criteria Items 1 – 5 of the “Written Submittal” to determine a shortlist of respondents that will advance to the oral presentation and negotiation phase of the solicitation process.

b. The committee may opt to invite all respondents to the oral presentation and negotiations phase of the solicitation process.

2. Determine Final Ranking of Respondents

a. The District will re-evaluate the Proposals after the oral presentation and negotiation phase and receipt of BAFOs to determine a final score for each Respondent. The initial score will not be considered in the final score of each Respondent.

Responses shall include information or documentation regarding, and will be evaluated using, the evaluation criteria set forth below. The evaluation rating scale is as follows:

More than adequate ………….8 – 10 Less than adequate …………1 – 4 Adequate …………………….5 – 7 Not covered in submittal …...0

ITN 39403 - Cybersecurity Assessment Criteria Weight

Written Submittal Written Submittal, Oral

Presentations & BAFO

Note: If the Evaluation Committee determines that the written Proposals are sufficient to finalize its rankings of Respondents, then oral presentations will not be required and the total scores for the written Proposals will be used to determine the rankings.

Raw Score

Weighted

Raw Score

Weighted

Tab 1: Organizational Profile: Respondent’s and Subconsultants’ overall background, qualifications, capabilities, experience, and availability to conduct work as presented in the Statement of Work (Complete all District-provided forms).

1. Description of the Respondent firm and their overall qualifications and capabilities

2. Organizational structure and specific names, functions, and availability of key personnel (include resumes)

3. Organization’s experience with penetration testing

4. Required Administrative Forms: Proposal Form, Certificate as to Corporation Form, Affidavit as to Non-Collusion and Certification of Material Conformance with Specifications, Qualifications — General Form, Proposed Subconsultants, and Drug-Free Workplace Form

10%

Tab 2: Client References - provide three references from projects successfully completed within the past three years immediately preceding the date of receipt of Submittals.

1. Qualifications Form — Client References; Letters of reference from at least three of those listed on the Client REFERENCES form

2. Qualifications Form — Similar Project (s)

5%

Tab 3: Technical qualifications and experience of key personnel in cybersecurity assessment projects emphasis on projects successfully completed within the last 3 years.

1. Staffing functions, names, qualifications, certifications, and resumes

2. Allocation of staff assigned to the Project

20%

- 11 -

Tab 4: Technical Merit (Statement of Work): Respondent provided Proposal.

1. Understanding of requested services

2. Understanding and experience with NIST CSF and FIPS 199

3. Understanding of data governance

4. Understanding of storage of sensitive data

5. Approach to assessment

6. Approach to penetration testing

7. Implementation and Service Methodology

8. Adequately addresses project objectives

9. Proposed incremental milestones and deliverables

35%

Tab 5: Cost Effectiveness: Cost Schedule Form The Respondent whose proposed cost is the lowest will receive a Cost Score of 10. All other Proposals will be scored proportionately using the following formula: Multiply the lowest proposed amount by 10, divide that amount by the next lowest amount to determine the Plan Design Cost Score, and so forth.

30%

TOTALS 100%

17. EXECUTION OF AGREEMENT

Submittal of a Proposal binds the Successful Respondent to perform the Work upon acceptance of the Proposal and execution of the Agreement by the District.

Unless all Proposals are rejected, a contract substantially in the form included in these documents will be provided to the Successful Respondent, who must execute and return the Agreement to the District within ten days of the date of receipt, along with the following:

a. A completed Internal Revenue Service Form W-9

b. Satisfactory evidence of all required insurance coverage

c. Proof satisfactory to the District of the authority of the person or persons executing the Agreement on behalf of Respondent

d. All other information and documentation required by the Agreement

The District will not execute the Agreement until the above documents have been executed and delivered to the District. The Agreement will not be binding until executed by the District. A copy of the fully executed Agreement will be delivered to the Successful Respondent. The District reserves the right to cancel award of the Agreement without liability at any time before the Agreement has been fully executed by all parties and delivered to the Successful Respondent.

Failure upon the part of the Successful Respondent to execute the Agreement or timely submit the required evidence of insurance coverage, or any other matter required by the Agreement, will be just cause, if the District so elects, for the recommended award to be annulled.

18. EXAMINATION OF AGREEMENT DOCUMENTS AND WORK AREA

Respondent is solely responsible for being fully informed of the conditions under which the Work is to be performed in relation to existing conditions. Respondent is responsible for carefully examining the general area of the Work, the requirements of the drawings and other contract documents related to the Work, the time in which the Work must be completed, and any other details of the Work. Respondent must satisfy itself from its own personal knowledge and experience or professional advice as to the character of the Work, the conditions and materials to be encountered, the character, quality, and quantities of the Work, and any other conditions affecting the Work, including surrounding land.

Failure to satisfy the obligations of this paragraph will not relieve a Successful Respondent of its obligation to furnish all material, equipment, and labor necessary to perform the Agreement and to complete the Work for the consideration set forth in its proposal. Any such failure will not be sufficient cause to submit a claim for additional compensation.

No verbal agreement or conversation with any District officer, agent or employee, either before or after the execution of the Agreement, will affect or modify any of its terms.

- 12 -

19. DIVERSITY OPPORTUNITY

The District is committed to the opportunity for diversity in the award and performance of all procurement activities. The District encourages its Respondents to make a good faith effort to ensure that women and minority-owned business enterprises (W/MBE) are given the opportunity for maximum participation as second and lower tier participants. The District will assist Respondents by sharing information on W/MBEs to encourage their participation.

20. FLORIDA SALES TAX

The District is exempt from payment of State of Florida sales tax pursuant to §212.08(6), Fla. Stat. Any tangible personal property that is the subject of this Invitation to Negotiate is intended to remain tangible personal property and not become part of a public work owned by the District.

21. PUBLIC ENTITY CRIMES/DISCRIMINATORY VENDORS

In accordance with §287.133 and §287.134, Fla. Stat., a person or affiliate who has been placed on the convicted vendor list following a conviction for a public entity crime or placed on the discriminatory vendor list may not submit a bid, proposal, or reply on a contract to provide any goods or services to a public entity;

may not submit a bid, proposal, or reply on a contract with a public entity for the construction or repair of a public building or public work; may not submit bids, proposals, or replies on leases of real property to a public entity; may not be awarded or perform work as a Consultant, supplier, subconsultant, or consultant under a contract with any public entity; and may not transact business with any public entity in excess of the threshold amount provided in §287.017 for CATEGORY TWO ($35,000) for a period of 36 months following the date of being placed on the convicted or discriminatory vendor lists.

22. USE BY OTHER FLORIDA GOVERNMENTAL ENTITIES

Respondent may provide services to other State of Florida governmental entities pursuant to the terms and conditions of the Agreement. These governmental entities include other water management districts, state of Florida agencies (including members of the state university system and community college system), counties, school boards, municipalities, special districts, and other local public agencies or authorities.

References to the St. Johns River Water Management District in the Agreement will be replaced with the purchasing entity and the District will not be a party to any other governmental entity’s agreement to purchase. Nor will the District be responsible for payment for any goods or services delivered or performed for any other governmental entity that utilizes Respondent pursuant to this paragraph.

23. NOTICES AND SERVICES THEREOF

The District will publish notice of specifications and criteria, including addenda, intended agency decisions, or other matters pertinent to this solicitation on Onvia DemandStar at DemandStar.com, Central Bidding at centralauctionhouse.com, and Vendor Registry at vendorregistry.com. Onvia DemandStar and Vendor Registry may also be accessed through the District’s web site at sjrwmd.com. In addition, the District will post notices of intended agency decisions at the District’s headquarters, 4049 Reid Street, Palatka, Florida, Administration Building, Procurement Bulletin Board, on the date the publication is posted on Onvia DemandStar.

Notices will be posted for a minimum of 72 hours. The time period for filing a Notice of Protest pursuant to §120.57(3), Fla. Stat., and Rule 28-110.003, Fla. Admin. Code, commences at the time notices are posted.

As a courtesy to Respondents, the District may send copies of the notices of intended agency decisions via email or facsimile to Respondent. These courtesy communications neither constitute official notice nor vary the times of receipt set forth above.

- 13 -

24. PROHIBITION AGAINST CONSIDERING SOCIAL, POLITICAL, OR IDEOLOGICAL

INTERESTS IN GOVERNMENT CONTRACTING – F.S. 287.05701

Notice is hereby provided that pursuant to Section 287.05701, Florida Statutes, the District (1) will not request documentation of or consider a Respondent’s social, political, or ideological interests when determining if the Respondent is a responsible respondent and (2) may not give preference to a Respondent based on the Respondent's social, political, or ideological interests.

25. PROTEST PROCEDURES

Pursuant to§120.57(3), Fla. Stat., and Rule 28-110.003, Fla. Admin. Code, any person adversely affected by the terms, conditions, or specifications contained in a solicitation, including addenda, must file a Notice of Protest within 72 hours after its posting.

Pursuant to §120.57(3), Fla. Stat., and Rule 28-110.003, Fla. Admin. Code, any person adversely affected by a District decision or intended decision to award a contract, or to reject all bids, proposals, or qualifications, must file a written Notice of Protest within 72 hours after posting of the decision or intended decision.

Pursuant to §120.57(3), Fla. Stat., and Rule 28-110.004, Fla. Admin. Code, the protester must also file with the District Clerk a Formal Written Protest within ten days after the date the Notice of Protest is filed with the District. The Formal Written Protest must state with particularity the facts and law upon which the protest is based. Pursuant to §287.042(2)(c), Fla. Stat., any person who files an action protesting the decision or intended decision must post with the District Clerk at the time of filing the formal written protest a bond, cashier’s check, or money order made payable to the St. Johns River Water Management District in an amount equal to one percent (1%) of the District’s estimated contract amount.

No additional time will be added for mailing. All filings must comply with Rule 28-106.104, Fla. Admin.

Code, and must be addressed to and received by the District Clerk at the District Headquarters in Palatka, Florida within the prescribed time periods. The District will not accept as filed any electronically transmitted facsimile pleadings, petitions, Notice of Protest or other documents.

The District’s acceptance of pleadings, petitions, Notice of Protest, Formal Written Protest, or other documents filed by email is subject to certain conditions set forth in the District’s Statement of Agency Organization and Operation (issued pursuant to Rule 28-101.001, Florida Administrative Code), which is available for viewing at sjrwmd.com. These conditions include, but are not limited to, the document being in the form of a PDF or TIFF file and being capable of being stored and printed by the District.

Failure to file a protest within the time prescribed in §120.57(3), Fla. Stat., or failure to post the bond or other security required by law within the time allowed for filing a bond will constitute a waiver of proceedings under chapter 120, Fla. Stat. Mediation under §120.573, Fla. Stat., is not available.

- 14 -

FORMS

PROPOSAL FORM

Include this form in the response in digital format as a PDF.

RESPONDENT:

The undersigned, as Respondent, hereby declares and certifies that the only person(s) or entities interested in this proposal as principal(s), or as persons or entities who are not principal(s) of the Respondent but are substantially involved in performance of the Work, is or are named herein, and that no person other than herein mentioned has any interest in this proposal or in the Agreement to be entered into; that this proposal is made without connection with any other person, company, or parties making a proposal; and that this proposal is in all respects fair and in good faith without collusion or fraud.

Respondent represents to the District that, except as may be disclosed in an addendum hereto, no officer, employee or agent of the District has any interest, either directly or indirectly, in the business of Respondent to be conducted under the Agreement, and that no such person shall have any such interest at any time during the term of the Agreement, should it be awarded to Respondent.

Respondent further declares that it has examined the Agreement and informed itself fully in regard to all conditions pertaining to this solicitation; it has examined the specifications for the Work and any other Agreement documents relative thereto; it has read all of the addenda furnished prior to the proposal opening, as acknowledged below; and has otherwise satisfied itself that it is fully informed relative to the Work to be performed.

Respondent agrees that if its proposal is accepted, Respondent shall contract with the District in the form of the attached Agreement and shall furnish everything necessary to complete the Work in accordance with the time for completion specified in the Agreement and shall furnish the required evidence of the specified insurance.

Acknowledgment is hereby made of the following addenda (identified by number) received:

Addendum No. Date Addendum No. Date

Respondent (firm name) Date

Address

Email address

Signature Telephone number

Typed name and title

- 15 -

COST SCHEDULE

Include this form in the response in digital format as a PDF.

Proposal to be opened at 2:00 p.m., March 12, 2024.

To: ST. JOHNS RIVER WATER MANAGEMENT DISTRICT

In accordance with the advertisement requesting proposals for the Cybersecurity Assessment, subject to the terms and conditions of the Agreement, the undersigned proposes to perform the Work for the price contained in the Cost Schedule form submitted under the “Tab 5” subfolder (Cost Schedule form and Proposal, completed by Respondent).

COST SCHEDULE

Respondent’s Name:

ITN 39403 - Cybersecurity Assessment

SERVICES TOTAL PROPOSAL COST*

Cybersecurity Assessment $__ _______

Total Project Cost in words: ________________________________________________________________

If said Proposal exceeds the estimated amount set forth in the District’s solicitation, the District expressly reserves the right to increase, decrease, or delete any class, item, or part of the Work, as may be determined by the District.

Respondents are reminded to refer to “PREPARATION AND ORGANIZATION OF SUBMITTAL DOCUMENTS” for information to be included with the proposal package.

Pursuant to §287.084(2) Fla. Stat., a vendor whose principal place of business is outside the state of Florida must accompany any written bid, proposal, or reply documents with a written opinion of an attorney at law licensed to practice law in that foreign state, as to the preferences, if any or none, granted by the law of that state to its own business entities whose principal places of business are in that foreign state in the letting of any or all public contracts.

I HEREBY ACKNOWLEDGE, as Respondent’s authorized representative, that I have fully read and understand all terms and conditions as set forth in this proposal and upon award of such proposal, shall fully comply with such terms and conditions.

Date

Respondent (firm name)

Address

E-mail address

Signature Telephone number

Typed name and title

- 16 -

CERTIFICATE AS TO CORPORATION

Include this form in the response in digital format as a PDF.

The below Corporation is organized under the laws of the State of ; is authorized by law to respond to this Invitation to Negotiate and perform all work and furnish materials and equipment required under the Agreement and is authorized to do business in the state of Florida.

Corporation name:

Address:

Registration No.:

Registered Agent:

By:

(Official title) (Affix corporate seal)

Attest:

(Secretary)

The full names and business or residence addresses of persons or firms interested in the foregoing proposal as principals or officers of Respondent are as follows (specifically include the President, Secretary, and Treasurer and state the corporate office held of all other individuals listed):

Identify any parent, subsidiary, or sister corporations involving the same or substantially the same officers and directors that will or may be involved in performance of the Project, and provide the same information requested above on a photocopy of this form.

If applicable, attach a copy of a certificate to do business in the state of Florida, or a copy of the application that has been accepted by the state of Florida to do business in the state of Florida, for the Respondent and/or all out-of-state corporations that are listed pursuant to this form.

- 17 -

AFFIDAVIT AS TO NON-COLLUSION AND CERTIFICATION OF

MATERIAL CONFORMANCE WITH SPECIFICATIONS

Include this form in the response in digital format as a PDF.

STATE OF

COUNTY OF

I, the undersigned, being first duly sworn, depose and say that:

1. I am the owner or duly authorized officer, representative, or agent of:

the Respondent that has submitted the attached proposal.

2. The attached proposal is genuine. It is not a collusive or sham proposal.

3. I am fully informed respecting the preparation and contents of, and knowledgeable of all pertinent circumstances respecting the attached proposal.

4. Neither Respondent nor any of its officers, partners, owners, agents, representatives, employees, or parties in interest, including this affiant, has in any way colluded, conspired, connived, or agreed, directly or indirectly, with any other Respondent, firm, or person to submit a collusive or sham proposal in connection with the Agreement for which the attached proposal has been submitted, or to refrain from proposing in connection with such Agreement, or has in any manner, directly or indirectly, sought by agreement, collusion, communication, or conference with any other Respondent, firm, or person to fix the price or prices in the attached proposal of any other Respondent , or to fix any overhead, profit, or cost element of the proposal prices or the proposal price of any other Respondent, or to secure through collusion, conspiracy, connivance, or unlawful agreement any advantage against the District or any other person interested in the proposed Agreement.

5. The price(s) quoted in the attached proposal are fair and proper and are not tainted by any collusion, conspiracy, connivance, or unlawful agreement on the part of the Respondent or any of its agents, representatives, owners, employees, or parties in…