Ogdensburg_Cybersecurity_RFP (v1).pdf

RFP 2026-SECURE-01 — Cybersecurity Risk Assessment City of Ogdensburg, NY

CITY OF OGDENSBURG, NEW YORK

REQUEST FOR PROPOSALS

RFP No. 2026-SECURE-01

Cybersecurity Risk Assessment — Water and Wastewater Systems

Issued in connection with the New York State Environmental Facilities Corporation (EFC)

SECURE Program — Cybersecurity Assessment Grant

Issued By: City of Ogdensburg, New York — Office of the City Manager

Issue Date: October 1, 2026

Questions Due: October 22, 2026, 4:00 PM (Eastern)

Addenda Issued By: October 30, 2026

Proposals Due: November 20, 2026, 4:00 PM (Eastern)

Anticipated Award: January 2027

Not-to-Exceed Budget: $45,000.00 (all-inclusive)

Contact: Deb Langley, Technical Specialist, dlangley@ogdensburgny.gov

1. Introduction and Background

The City of Ogdensburg (“City”) is requesting proposals from qualified firms to perform a comprehensive cybersecurity risk assessment of the City’s municipally owned drinking water system and wastewater (sewer) system (collectively, the “Systems”). This Request for Proposals (“RFP”) is issued in connection with, and is intended to satisfy the deliverable requirements of, the New York State Environmental Facilities Corporation (“EFC”) SECURE Program Assessment Grant awarded to the City for the 2026 SECURE Grants pilot year.

The SECURE Program (Supporting Cybersecurity Upgrades and Resilient Enhancements) provides funding to municipal water and wastewater systems across New York State to evaluate and strengthen cybersecurity posture in light of new cybersecurity regulations adopted by the New York State Department of Environmental Conservation (“DEC”) for wastewater systems and the New York State Department of Health (“DOH”) for public drinking water systems, both of which took effect March 1, 2026. Water and wastewater systems are designated by the federal Cybersecurity and Infrastructure Security Agency (CISA) as one of the nation’s 16 critical infrastructure sectors.

The City intends to engage a single qualified vendor (the “Consultant”) to assess both Systems under one contract.

Proposers may address the water system, the wastewater system, or both in their technical and cost proposals;

however, the City’s preference, and the basis on which proposals will be primarily evaluated, is a single integrated engagement covering both Systems within the not-to-exceed budget identified in Section 5.

2. Regulatory and Program Context

2.1 DEC and DOH Cybersecurity Regulations (Effective March 1, 2026) New York State adopted new cybersecurity regulatory requirements applicable to public water and wastewater systems, administered respectively by DOH (drinking water systems) and DEC (wastewater/sewer systems), which took effect March 1, 2026. The assessment produced under this RFP must evaluate the City’s current cybersecurity posture against these DEC and DOH requirements and must identify the specific gaps and prioritized remediation actions needed to bring each System into compliance. The Consultant is responsible for confirming the current, applicable text of the DEC and DOH cybersecurity rules in effect at the time of the engagement and for citing the specific provisions addressed in the assessment report.

2.2 NIST Cybersecurity Framework (CSF) 2.0

Consistent with EFC guidance provided to SECURE grant awardees (including the EFC “SECURE Program: Assessment Grant Awardee Webinar,” Community Assistance Teams, August 27, 2026, and the related recorded webinar at https://youtu.be/3IOKrh1goeI), the assessment must be conducted using the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) 2.0 and CIA Triad (Confidentiality, Integrity, Availability) principles as the methodology for evaluating risk and identifying vulnerability gaps between the City’s current systems and the DEC/DOH regulatory requirements described above. At minimum, the Consultant’s methodology must address all six NIST CSF 2.0 core functions:

• Govern — organizational context, cybersecurity strategy, roles, responsibilities, policy, and oversight;

• Identify — asset inventory and understanding of what needs to be protected;

• Protect — safeguards for critical infrastructure and services;

• Detect — timely discovery of cybersecurity events;

• Respond — actions taken regarding a detected incident; and

• Recover — restoration of capabilities and services impaired by an incident.

The Consultant’s proposal must describe how it will develop a Current Profile (where the Systems stand today) and a Target Profile (what is needed to meet DEC/DOH regulatory requirements), consistent with the NIST CSF 2.0 profile and tiering approach (Tier 1: Partial through Tier 4: Adaptive), and must describe its plan for closing the gap between the two.

2.3 SECURE Assessment Grant Deliverable Requirements

Per EFC program guidance, an acceptable assessment deliverable must, at minimum:

• Be documented in a written cybersecurity risk assessment report;

• Include an executive summary of cybersecurity needs for each System, including a generalized listing of needed remediations (EFC does not require submission of an exact, itemized list of identified vulnerabilities to the City or EFC — see Section 3.6 regarding confidentiality);

• Use the CIA Triad / NIST CSF 2.0 to evaluate risk and vulnerability gaps between the current System(s) and the applicable DEC (wastewater) and/or DOH (drinking water) regulations;

• Identify specific, prioritized remediation actions needed to meet DEC/DOH regulations;

• Identify priority needs to inform future implementation (capital and operational) work; and

• Be dated after March 1, 2026, to be eligible for grant reimbursement.

This RFP’s Scope of Services (Section 3) incorporates each of these requirements as a mandatory deliverable element.

3. Scope of Services

The selected Consultant shall furnish all labor, supervision, materials, and expertise necessary to perform a cybersecurity risk assessment of the City’s water system and wastewater system, and to prepare the deliverables described below.

3.1 Task 1 — Project Initiation and Data Collection

• Conduct a kickoff meeting with City staff (City Manager, Director of Public Works, and relevant water/wastewater operations staff) to confirm scope, points of contact, and system access.

• Gather information on existing information technology (IT) and operational technology (OT)/industrial control system (ICS) architecture, including SCADA, PLCs, remote telemetry, and any internet-facing or remotely accessible systems, for both the water and wastewater systems.

• Review existing policies, procedures, network diagrams, and any prior assessments (EPA, CIS, or other frameworks) already in use by the City, and map them to NIST CSF 2.0 to avoid duplicative effort.

3.2 Task 2 — Current Profile: Risk and Vulnerability Assessment

• Perform an on-site and/or remote technical and administrative assessment of both Systems using NIST CSF 2.0 and CIA Triad methodology across all six core functions (Govern, Identify, Protect, Detect, Respond, Recover).

• Identify cybersecurity vulnerabilities and gaps in governance, network architecture, access controls, physical security of control systems, remote access, patch management, backup/recovery capability, and incident response readiness.

• Develop a NIST CSF 2.0 “Current Profile” for each System reflecting the City’s existing cybersecurity posture and maturity tier.

3.3 Task 3 — Target Profile and Regulatory Gap Analysis

• Develop a NIST CSF 2.0 “Target Profile” for each System reflecting the cybersecurity posture required to comply with the applicable DOH drinking water cybersecurity regulation and/or DEC wastewater cybersecurity regulation in effect as of March 1, 2026.

• Perform a gap analysis comparing the Current Profile to the Target Profile, with each identified gap cross-referenced to the specific DEC and/or DOH regulatory provision it relates to.

3.4 Task 4 — Prioritized Remediation and Implementation Roadmap

• Develop a specific, prioritized list of remediation actions necessary to close identified gaps and achieve

DEC/DOH regulatory compliance, organized by priority (e.g., immediate/high, near-term, long-term) and by NIST CSF 2.0 function.

• Identify priority needs and order-of-magnitude cost considerations to inform the City’s future SECURE Implementation Grant application and capital planning.

3.5 Task 5 — Deliverables

• Draft Cybersecurity Risk Assessment Report for City review and comment, addressing all elements in Sections

2.3 and 3.1–3.4 above, for each System.

• Executive Summary of cybersecurity needs for each System, suitable for the City to submit to EFC, presenting a generalized (non-sensitive) summary of remediation needs without disclosing an exact, itemized list of identified vulnerabilities.

• Final Cybersecurity Risk Assessment Report and Executive Summary, incorporating City comments, dated after March 1, 2026, in a form acceptable for submission to and acceptance by EFC under the SECURE Assessment Grant.

• A verbal or written summary presentation of findings and the prioritized remediation roadmap to the City Manager, Director of Public Works, and City Council (or a council committee), as reasonably requested by the City.

3.6 Confidentiality and Handling of Sensitive Information

Because the assessment will identify specific cybersecurity vulnerabilities in critical public infrastructure, the Consultant shall treat all assessment work papers, vulnerability details, and system architecture information as confidential and shall not disclose such information to any third party without the City’s prior written consent, except as required by law or as necessary to submit the Executive Summary to EFC. The Consultant’s proposal must describe its data handling, storage, and transmission security practices for sensitive assessment information.

4. Project Schedule

The City anticipates the schedule below. Dates other than the Proposal Due Date are estimates and may be adjusted by the City. Note that EFC anticipates delivering executed grant agreements to municipalities before the end of September 2026 and estimates that the first SECURE Assessment Grant disbursements will be available on or about November 1, 2026; the schedule below is intended to align contract execution with that funding timeline.

Milestone Date

RFP Issued October 1, 2026

Deadline for Written Questions October 22, 2026, 4:00 PM

City Responses / Addenda Issued October 30, 2026

Proposals Due November 20, 2026, 4:00 PM

Interviews (if held) Week of December 7, 2026

Anticipated Notification of Award January, 2027

Anticipated Contract Execution / Notice to Proceed February 2027

Draft Assessment Report Due Within 120 calendar days of Notice to Proceed

Final Assessment Report Due Within 60 calendar days of receipt of City comments on draft

5. Budget and Grant Funding Terms

This project is funded through an EFC SECURE Assessment Grant. Proposers must submit a firm, all-inclusive, not-to-exceed price to perform the full Scope of Services in Section 3 for both the water system and the wastewater system combined. The City will not consider, and will deem non-responsive, any proposal with a total price exceeding:

$45,000.00 (Forty-Five Thousand Dollars), all-inclusive

The not-to-exceed amount must include all labor, travel, subconsultant costs, materials, report production, and any other cost of performance. Proposers are encouraged, but not required, to also submit an optional itemized fee breakdown by System (water / wastewater) and by task, using Attachment A.

5.1 Grant Disbursement and Invoicing Context

Proposers should be aware that EFC disburses SECURE Assessment Grant funds to the City in two phases: (1) 50% upon execution of the resulting professional services contract, and (2) the remaining 50% upon EFC’s acceptance of a completed and approved assessment. The City’s ability to pay the Consultant is dependent on receipt of these grant funds from EFC. Proposers should structure their proposed payment schedule (see Attachment A) accordingly — for example, an initial payment upon contract execution / notice to proceed, and a final payment upon City and EFC acceptance of the final report.

5.2 Grant Program Terms Applicable to This Procurement

Per EFC SECURE Program guidance, this procurement is not subject to EFC-imposed MWBE/SDVOB participation goals or the standard EFC grant Terms & Conditions. However, the City is conducting this procurement in accordance with the City’s own procurement policy and applicable New York State law. All proposers must certify their eligibility to contract with a New York municipality, including that neither the proposer nor any proposed subcontractor is currently listed as ineligible to submit a bid or propose on, or be awarded, a public work contract under New York Labor Law § 220-b, or ineligible to submit a bid on, or be awarded, a State contract under New York Executive Law § 316 (see Attachment B).

Contractor must be aware that contracting will include EFC’s current terms and conditions.

6. Minimum Qualifications

To be considered responsive, a proposer must demonstrate, at minimum:

1. Demonstrated experience performing cybersecurity risk assessments for water and/or wastewater utilities or other operational technology (OT)/industrial control system (ICS) environments, including at least three (3) similar engagements completed within the past five (5) years;

2. Working knowledge of the NIST Cybersecurity Framework (CSF) 2.0 and demonstrated ability to apply it to water/wastewater sector environments;

3. Working knowledge of (or demonstrated ability to research and apply) the DEC wastewater cybersecurity regulation and the DOH drinking water cybersecurity regulation effective March 1, 2026;

4. Assigned staff with relevant credentials (e.g., CISSP, CISM, GICSP, CEH, or equivalent OT/ICS cybersecurity experience) and, if applicable, appropriate security clearance or background screening for access to critical infrastructure;

5. Ability to begin work promptly upon Notice to Proceed and complete the engagement within the schedule in Section 4; and

6. Financial and organizational capacity to perform the engagement for the not-to-exceed price in Section 5.

7. Proposal Format and Content

Proposals must be organized in the following order and sections. Proposals that do not substantially conform to this format may be deemed non-responsive.

7.1 Cover Letter

A signed cover letter (maximum 2 pages) identifying the firm, primary contact, and a statement that the proposal is valid for at least 90 days from the submission deadline.

7.2 Firm Qualifications and Experience

Firm background, relevant water/wastewater cybersecurity project experience, and at least three (3) references (Attachment C) for similar completed engagements, including client name, contact information, project description, and dates.

7.3 Key Personnel

Resumes and relevant certifications for all personnel proposed to perform the work, and identification of the engagement/project manager who will serve as the City’s primary point of contact.

7.4 Technical Approach and Work Plan

A detailed narrative describing the proposer’s methodology for each task in Section 3, including how the NIST CSF 2.0 Current/Target Profile approach will be applied, how DEC and DOH regulatory requirements will be researched and incorporated, data collection and site-visit approach, and proposed project schedule with milestones consistent with Section 4.

7.5 Sample Deliverable

A redacted or sample cybersecurity risk assessment report (or excerpt) from a prior engagement, illustrating the proposer’s reporting format and level of detail.

7.6 Cost Proposal

A completed Attachment A, presenting the firm, all-inclusive, not-to-exceed total price, and (optionally) an itemized breakdown by task and by System, along with the proposed payment schedule.

7.7 Required Certifications

A completed and signed Attachment B (Non-Collusion and Eligibility Certification).

8. Submission Instructions

Proposers must submit one (1) original, three (3) paper copies, and one (1) electronic copy (PDF, on USB drive or by email to the address below) of the complete proposal, in a sealed package clearly marked “RFP No. 2026-SECURE-01

— Cybersecurity Risk Assessment,” no later than the Proposal Due Date and time identified in Section 4, to:

Deb Langley, Technical Specialist, dlangley@ogdensburgny.gov

City of Ogdensburg City Hall, 330 Ford Street, Ogdensburg, NY 13669 Attn: RFP No. 2026-SECURE-01 — Cybersecurity Risk Assessment

Electronic questions regarding this RFP must be submitted in writing to dlangley@ogdensburgny.gov no later than the Questions Due date in Section 4. The City will issue written answers to all substantive questions to all known proposers by the date identified in Section 4. Proposals received after the deadline or submitted by fax or unsecured email without a hard copy as required, will not be considered.

The City reserves the right to reject any or all proposals, to waive informalities or irregularities in proposals received, to negotiate with one or more proposers, to request clarifications or best-and-final offers, and to award the contract in a manner determined to be in the best interest of the City. This RFP does not commit the City to award a contract or to pay any costs incurred in the preparation of a proposal.

9. Evaluation Criteria and Selection Process

Proposals will be reviewed by a City evaluation committee based on the following weighted criteria. The City may, at its discretion, invite one or more proposers to interview before final selection.

Evaluation Criterion Weight

Firm qualifications, relevant experience, and references 25%

Qualifications of key personnel assigned to the project 15%

Technical approach, understanding of NIST CSF 2.0 and DEC/DOH regulatory requirements, and quality of sample deliverable 30%

Proposed schedule and ability to meet City timeline 10%

Cost proposal (value within the not-to-exceed budget) 20%

Note: Proposals exceeding the $45,000 not-to-exceed budget in Section 5 will be deemed non-responsive and will not be evaluated.

10. General Terms and Conditions

• Contract Form: The selected Consultant will be required to execute the City’s standard professional services agreement, which may incorporate the Consultant’s proposal by reference. The City Attorney will review the final contract prior to execution.

• Insurance: The selected Consultant must maintain commercial general liability, professional liability (errors and omissions, including cyber liability/technology E&O), automobile liability, and workers’ compensation insurance in amounts to be specified in the final contract, and must name the City of Ogdensburg as an additional insured where applicable.

• Eligibility: Neither the proposer nor any proposed subcontractor may be an entity or individual ineligible to contract with a public entity under New York Labor Law § 220-b or New York Executive Law § 316.

• No MWBE/SDVOB Mandate: Consistent with EFC SECURE Program guidance, this procurement does not carry EFC-imposed MWBE/SDVOB participation requirements; however, the City encourages participation by certified minority- and women-owned and service-disabled veteran-owned businesses.

• Ownership of Work Product: All reports, data, and work product developed under the resulting contract shall become the property of the City upon final payment, subject to the confidentiality provisions in Section 3.6.

• Independent Contractor: The Consultant shall perform all work as an independent contractor and not as an employee or agent of the City.

• Non-Discrimination: The Consultant shall comply with all applicable federal, state, and local non-discrimination and equal employment opportunity laws.

• Grant Compliance: The Consultant shall reasonably cooperate with the City in providing documentation (e.g., executed contract, invoices, and reports) necessary for the City to request and receive disbursement of SECURE Assessment Grant funds from EFC.

• Right to Reject: The City reserves the right to reject any and all proposals, to reissue this RFP, or to cancel this procurement at any time, without liability to any proposer.

• Contract documents will include EFC’s current terms and conditions.

11. Attachments

• Attachment A — Cost Proposal Form

• Attachment B — Non-Collusion and Eligibility Certification

• Attachment C — Reference Form

Attachments follow on subsequent pages.

Attachment A — Cost Proposal Form

Proposer Name: _______________________________________________

Task Water System ($) Wastewater System

Task 1 — Project Initiation and Data Collection

Task 2 — Current Profile: Risk and Vulnerability Assessment

Task 3 — Target Profile and Regulatory Gap Analysis

Task 4 — Prioritized Remediation and Implementation Roadmap

Task 5 — Deliverables and Presentation

Subtotal

Combined Not-to-Exceed Total Price (Water + Wastewater): $ ______________

(This figure must not exceed $45,000.00. Itemized amounts above are optional but encouraged; the combined total governs responsiveness.)

Proposed Payment Schedule Describe the proposed invoicing/payment milestones (e.g., percentage due at Notice to Proceed, at draft report submission, and at final report acceptance):

Authorized Signature: ______________________________ Date: ______________

Attachment B — Non-Collusion and Eligibility Certification

The undersigned, on behalf of the proposing firm, certifies to the City of Ogdensburg as follows:

7. The proposal submitted has been arrived at independently, without collusion, consultation, communication, or agreement with any other proposer or competitor for the purpose of restricting competition.

8. The proposing firm is not currently identified on the New York State Department of Labor’s list of entities ineligible to submit a bid on, or be awarded, a public work contract pursuant to New York Labor Law § 220-b.

9. The proposing firm is not currently identified on the New York State list of entities ineligible to submit a bid on, or be awarded, a State contract pursuant to New York Executive Law § 316.

10. No subcontractor proposed for use on this engagement is, to the proposer’s knowledge, ineligible under Labor Law § 220-b or Executive Law § 316.

11. All information contained in the accompanying proposal is true and accurate to the best of the undersigned’s knowledge.

Firm Name: ______________________________________________________

Authorized Signature: ______________________________ Title: ______________

Date: ______________

Attachment C — Reference Form

Provide at least three (3) references for similar cybersecurity assessment engagements, preferably for water/wastewater or other OT/ICS environments, completed within the past five (5) years.

Reference 1 Client/Organization Name: _______________________________________________

Contact Name and Title: _________________________________________________

Phone / Email: __________________________________________________________

Project Description and Dates: ___________________________________________

Reference 2 Client/Organization Name: _______________________________________________

Contact Name and Title: _________________________________________________

Phone / Email: __________________________________________________________

Project Description and Dates: ___________________________________________

Reference 3 Client/Organization Name: _______________________________________________

Contact Name and Title: _________________________________________________

Phone / Email: __________________________________________________________

Project Description and Dates: ___________________________________________