Mandatory Virtual Conference - Countywide Security Assessment and Risk Analysis - 7-16-2026~1.pptx
PPTX presentation 8 MB Posted
- Attached to
- Countywide Security Assessment and Risk Analysis
- Solicitation number
- ISD126-ADM-6361
- Issued by
- California
About this file
This is a mandatory virtual proposal conference presentation for San Bernardino County's Innovation and Technology Department in California regarding RFP ISD126-ADM-6361 for a Countywide Security Assessment and Risk Analysis. The scope encompasses three integrated prongs across 47 county departments and 16 Health Care Component departments. Prong One involves a comprehensive countywide security assessment and risk analysis (SARA) to be conducted during the first year, including manual attack testing, external and internal network penetration testing, physical security assessments, wireless penetration testing, firewall reviews, mobile device testing, social engineering campaigns, and security architecture reviews across up to 55,000 unique active host IP addresses, with follow-up health checks scheduled between six to eighteen months post-completion. Prong Two requires HIPAA and HITECH gap and risk analyses for covered departments every two years, including HIPAA Risk Analysis, Security Rule Gap Analysis, and Privacy Rule Gap Analysis aligned with Title 45 of the Code of Federal Regulations. Prong Three offers optional buffet-style services allowing individual departments to select additional compliance assessments for areas such as Personally Identifiable Information, Criminal Justice Information Services (CJIS), and Family Educational Rights and Privacy Act (FERPA) requirements. The mandatory proposal conference was held virtually on July 16, 2026, with attendance verification required via chat sign-in; proposals were due August 6, 2026, and must be submitted electronically through the County's eProcurement system (ePro). The contract term is five years with recurring Prong Two assessments every two years.
The estimated Year One budget is $1,066,750, representing completion of all required Prong One and Prong Two activities, with pricing for subsequent years not to exceed this amount. All price quotations must cover the full scope of services, tasks, and deliverables, with any exceptions or qualifications clearly identified alongside relevant deliverables to enable equivalent proposal comparison. Work must be performed within the continental United States with on-site presence required at most facilities, coordinated with County escorts. Assessment work must align with NIST standards, including NIST SP 800-30 risk methodology and NIST AI Risk Management Framework, and the County has adopted ISO/IEC 27001 as its security control framework. This is a new opportunity with no incumbent. Monthly invoicing is submitted in arrears, and the County does not apply standard retainage pending deliverable acceptance. Specific asset quantities, network configurations, firewall platforms, and detailed social engineering parameters will be determined during the planning phase following contract award. Procurement inquiries should be directed to Christine Onyango (909-388-5943) or Jeremiah Thomas (909-388-0641) at the Innovation and Technology Department, with eProcurement system questions directed to epro.vendor@pur.sbcounty.gov.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
RFP Title: Countywide Security Assessment and Risk Analysis Mandatory Proposal Conference
RFP#: ISD126-ADM-6361
Department: Innovation and Technology Division: Finance and Administration
DATE: 7/16/2026
Name:
Christine Onyango – Staff Analyst II Jeremiah Thomas – Staff Analyst II
Department Division www.SBCounty.gov
When you change the information (Department and Division) on each of these 4 default master slides, your presentation will automatically change to reflect it. **Please be sure to change the information on each of the 4 master slides.**
House Rules San Bernardino County Team Introductions Department Program Requirements Proposal Timeline and Submission Procurement Contact Information Questions Agenda
Page ‹#›
Mandatory conference (No Proposal will be accepted and evaluated from any Proposer who fails to attend the virtual Proposal Conference ) Attendance Verification (Roll Call) – Please sign into the chat with your name/job title/the company name, and your email address (see sample below)
Please hold your questions until the end of each presentation Please submit all your questions, including the questions from today in ePro One person speaks at a time Please silence phones & electronic devices This meeting will be recorded for review and records
House Rules
San Bernardino County Team Introductions
Innovation and Technology Department (ITD) Staff
| Robert Pittman | Chief Information Security Officer (CISO) |
| Tim Ball | Deputy CISO, Business |
| Jason Hill | Deputy CISO, Threat Intelligence |
| Gary Bird | Business Systems Analyst III |
| Christine Onyango | Staff Analyst II |
| Jeremiah Thomas | Staff Analyst II |
| Lisa Zhu | Buyer III |
Program Requirements
Innovation and Technology Department Presenters
Robert Pittman, CISO
Jason Hill, Deputy CISO – Threat Intelligence
Program Requirements (2)
Comprehensive Countywide Information/Cyber Security Assessment
PROJECT DESCRIPTION
PRONG-ONE: Countywide SARA (Security assessment and risk analysis) Conducted during first year of engagement Scan every County internet protocol (IP) address (w/exceptions) Follow-up health checks occurring between six (6) and eighteen (18) months after completion of the SARA Forty-seven (47) departments are stated (designations are noted for Health Care Component and Separate Legal Entities)
SERVICES AND ACTIVITIES (not inclusive) Manual Attack Testing External (Internet) Network Penetration Testing Internal Network Penetration Testing Physical Assessment Wireless Penetration Testing Firewall Review Mobile Device Social Testing Security Architecture and Configuration Review Vulnerability Scanning
Program Requirements (3)
PRONG-TWO: HIPAA Gap and Risk Analysis Conduct a HIPAA and the HITECH (Health Information Technology for Economic and Clinical Health Act of 2009) gap and risk analysis A gap and risk analysis for Covered Departments will occur every two (2) years via a County coordinated effort to provide a holistic, consistent risk measurement process, and aggregated reporting HIPAA Covered Departments may engage the Consultant during the off-years from the County-coordinated process, as needed for additional gap and risk analysis services
SERVICES AND ACTIVITIES
Title 45 of the CFR is the baseline for these activities:
HIPAA Risk Analysis (same activities conducted in PRONG-ONE) HIPAA Security Rule Gap Analysis HIPAA Privacy Rule Gap Analysis
Program Requirements (4)
PRONG-THREE: Buffet Style Services and Activities (Optional for Depts.)
Each County department can select from a buffet menu of Assessment services and activities as a line-item that is an independent activity after the previous PRONG-ONE and PRONG-TWO efforts Our departments can select these services/activities to assess compliance with a variety of policies and regulations, such as:
Personally Identifiable Information Other regulatory compliance to be achieved depending on the requirements such as, but not limited to:
Criminal Justice Information Services (CJIS) Security Policy for California Family Educational Rights and Privacy Act (FERPA) Follow-up health checks after completion of the Assessment engagement and reports have been delivered
BUFFET STYLE SERVICES (not inclusive) Administration Exercises Operations Risk
Program Requirements (5)
WORKING RELATIONSHIP
Program Requirements (6)
Program Requirements (7)
Program Requirements (8)
PROJECT MILESTONES, TASKS AND DELIVERABLES
Program Requirements (9)
Program Requirements (10)
EXHIBITS SUMMARY
“A” – IP Summary for all Departments/Separate Entities (All PRONGS)
IP addresses will not exceed 55,000 unique host IPs (i.e., Active IPs)
Specific IP addresses and their ranges will be provided when appropriate and prior to the start of the engagement by establishing the detailed Project Work Plan
Some IPs will be EXCLUDED (e.g., medical devices) and identified during the planning phase of this engagement
Program Requirements (11)
“B” – HCC Department Locations (PRONG-TWO)
Program Requirements (12)
“C” – Price Quotation and Schedule (PRONG-ONE and PRONG-TWO)
All price quotations must be for the full services, tasks, and deliverables identified in this RFP, so that County can compare proposals on an equivalent basis
Any and all exceptions, qualifiers, restrictions, and respective adjustments to the price quotations must be identified and fully described alongside the relevant task or deliverable
See next slide for excerpted chart
Program Requirements (13)
Program Requirements (14)
Program Requirements (15)
Program Requirements (16)
Program Requirements (17)
“D” – Price Quotation and Schedule (PRONG-THREE)
Program Requirements (18)
“E” – Timeline (All PRONGS)
Illustrated below is the timeline that must be achieved
Six-month timeline enables all departments listed as a HIPAA covered entity to be evaluated starting at the same time with the administration component. Once the ADMIN component is completed for a department, that department will be assessed for the technical component, etc.
The below dates are subject to change as deemed necessary
Procurement Timeline
RFP contacts:
Note: Email both contacts simultaneously Email: Christine.Onyango@itd.sbcounty.gov Phone: 909-388-5943 Email: Jeremiah.Thomas@itd.sbcounty.gov Phone: 909-388-0641 eProcurement System (ePro) Questions/Issues epro.vendor@pur.sbcounty.gov Phone number: (909) 387-2060
Procurement Contact Information
Proposals will not be accepted by email or facsimile. Proposals must be submitted electronically through the County Electronic Procurement Network (ePro).
All Proposers must register with the ePro system prior to the date and time to submit the proposal, or they will be disqualified.
RFP Proposal Submission Method
Questions for the conclusion image1.png image2.png image3.png image7.png image8.png image9.png image10.png image11.png image12.jpg image13.jpeg image14.jpeg image15.jpg image16.jpg image17.jpg image18.png image19.jpg image20.jpeg image21.jpg image22.jpeg image23.jpg image24.jpg image25.png image26.png image27.png image6.emf
File details come from the government source that posted it. Updated .