Presentation Statewide Cybersecurity Resources RFP BPM057598.pdf

Introductions Brad Cary

Office of State Procurement

Procurement Officer II Bradley.cary1@maryland.gov

Request for Proposal

Statewide Cybersecurity Resources # BPM057598

Welcome

Department of General Services - Office of State Procurement (DGS-OSP)

• Brad Cary

Department of Information Technology– DoIT

• Lance Cleghorn, Senior Director of State Cyber Technology, DoIT

• Yevin Jayatilake, Cybersecurity Policy and Risk Analyst, DoIT

• Ernest Nnoko, Privacy Program Consultant, DoIT

MBE Liason – DGS - OSP Shirley Jackson -Sr. Compliance Officer Administrator - DGS - OSP - Strategic Sourcing and Procurement Diversity Programs

AGENDA

• General Information

• Proposal Submission Requirements

• Evaluation Criteria

• MBE / VSBE Requirements

• Scope of Work

• Questions & Inquiries

GENERAL INFORMATION

The purpose of today’s conference is to give information and guidance to potential offerors.

• All questions must be made in written format. See section 4.4 of the RFP for questions submission guidelines.

• In the event of a discrepancy between the information contained herein and the RFP documents, the RFP documents will take precedence.

• All communications must be sent through the Procurement Officer only.

• The Key information Summary Sheet in the RFP has all the pertinent contact information and deadlines.

• Any change or clarification to the RFP will be done via amendments posted on eMMA.

• Closing date for questions is August 17, 2026, at 2:00 PM Local Time.

• Proposals are due by September 18, 2026 at 2:00 PM Local Time.

• No late proposals will be accepted.

PROPOSAL SUBMISSION REQUIREMENTS

• Submission of Proposals must be done via eMMA

• If your company doesn’t wish to submit a proposal, please complete the Vendor Feedback Form.

• Per section 5.1 of the RFP, all proposals shall be submitted in 2 separate volumes.

1. Volume I is the Technical Proposal

2. Volume II is the Financial Proposal

• When submitting your Technical Proposal, please include a searchable Adobe copy with all confidential and proprietary information redacted.

• Please note that those proposals with commingled Technical and Financial Responses will be deemed non- susceptible for award.

• Offeror may respond to only one of the Functional Areas

When preparing the technical proposal:

• Clearly identify the solicitation point of contact for while the proposal is in the evaluation process.

• Proposals which include limited responses such as “concur” or “will comply” will receive a lower ranking than those that demonstrate an understanding of the work requirements.

• Any exceptions should be clearly identified in the Executive Summary. The State requires that all modifications to terms, conditions, and proposed language (by the offeror) be presented in writing to render an opinion on if the exceptions are legally acceptable. Acceptance or rejection of exceptions is within the sole discretion of the State.

In addition, the financial volume must contain all price information in the format specified in Attachment B:

• Submit your Financial Proposal on the price sheets provided, do not alter the attachment.

• Failure to complete the price sheet(s) or to sign the price sheet(s) may result in your proposal being not susceptible for award.

ORAL PRESENTATION

Offerors may be required to make oral presentations.

• Oral presentations – Date is To Be Determined (TBD).

EVALUATION CRITERIA

• Offeror’s understanding of the Functional Area’s scope and objectives

• Offeror Qualifications and Capabilities, including proposed subcontractors as noted in section 2.4.1

• Experience and Qualifications of Proposed Staff

• Demonstration of success in sourcing and providing resources to clients

• Economic Benefit to the State of Maryland

• MBE and VSBE participation and compliance

• Economic Benefit to State of Maryland

• Financial proposal

EVALUATION CRITERIA

(Down Select)

• As noted in 6.5.2 B, the state reserves the right to utilize the down select process.

• The down select will be based on a review of the Offeror’s Past Performance and Reference letters, where the Offeror demonstrates success in sourcing and providing resources to clients.

• The six most advantageous Proposals in each Functional Area will advance to the next phase in the technical evaluation process.

MBE AND VSBE REQUIREMENTS

Shirley Jackson, MBE Liaison with The Department of General Services

• As noted in the Key information Sheet of the RFP

• There is an overall MBE subcontracting goal of 15% for each functional area

• VSBE goal of 3% for each functional area

•Under Sections 4.15.1–4.15.4 of the RFP, the Offeror must oversee and remain accountable for all work, including that of MBE and VSBE subcontractors.

• Failure to include the completed forms will result in a determination that your Proposal is not susceptible for award.

SCOPE OF WORK

• This RFP is being issued to secure highly skilled professionals and teams capable of delivering advanced cybersecurity and privacy services across multiple domains, including governance, risk management and compliance.

• The scope of this solicitation encompasses the following three (3) Functional Areas:

Functional Area 1: Oversight and Governance Functional Area 2: Architecture, Engineering, and Implementation Functional Area 3: Protection and Defense

• A reminder that an Offeror should only respond to one of the three Functional Areas

SCOPE OF WORK – Functional Area 1

• Focuses on establishing and maintaining cybersecurity and privacy governance structures, policies and compliance frameworks.

Key Services:

Develop and maintain cybersecurity policies, standards and procedures.

Implement Governance, Risk, and Compliance (GRC) programs.

Conduct enterprise-wide risk assessments and audits.

Manage supply chain risk and third-party vendor security.

Oversee privacy compliance and data protection programs.

Deliver cybersecurity awareness and training initiatives.

Examples of Deliverables:

Statewide cybersecurity governance framework.

Risk management and compliance dashboards.

Privacy impact assessments and remediation plans.

Training materials and awareness campaigns.

SCOPE OF WORK – Functional Area 2

• Supports the entire lifecycle of secure technical environments, from initial design to active operation. It emphasizes integrating security into the software development lifecycle (DevSecOps) while providing the hands-on technical support required to deploy and configure cybersecurity tools.

Key Services:

Design and develop comprehensive system security architectures that align with Zero Trust principles and

State-mandated cybersecurity frameworks.

Integrate security protocols into the software development lifecycle by implementing DevSecOps pipelines and performing automated and manual secure code reviews.

Execute the physical and logical implementation of cybersecurity tools, including the installation and tuning of SIEM, IAM, and endpoint protection solutions.

Engineer and manage secure cloud and hybrid environments, ensuring that identity management and data encryption are consistently applied across all platforms.

Provide continuous technical support for the configuration and optimization of security hardware and software to ensure peak operational performance.

SCOPE OF WORK – Functional Area 2 Continued

Examples of Deliverables:

High-Level and Detailed Design Documents Security Configuration and Baselines DevSecOps Pipeline Documentation Tool Implementation and Tuning Reports.

Identity and Access Management (IAM) Schemas Infrastructure as Code (IaC) Scripts As-Built Documentation

SCOPE OF WORK – Functional Area 3

• This area provides advanced defensive capabilities to detect, respond to, and mitigate cybersecurity threats. It includes proactive threat hunting and incident response.

Key Services:

Staff Security Operations Centers (SOC) and Monitor for threats.

Conduct vulnerability assessments and penetration testing.

Perform threat intelligence analysis and reporting.

Execute incident response and forensic investigations Develop and maintain detection content for SIEM platforms.

Implement insider threat and advanced persistent threat (APT) detection.

Examples of Deliverables:

SOC operational reports and threat detection dashboards.

Penetration test results and remediation plans.

Threat intelligence briefs and indicators of compromise Incident response playbooks and post-incident reports.

QUESTIONS & INQUIRIES

Please be sure to submit questions in writing via email to Bradley.Cary1@Maryland.gov per the process identified in Section 4.4 of the RFP.

Please include the Solicitation Number and Title in the subject line: BPM057598 – STATEWIDE CYBERSECURITY RESOURCES

Contact Information

• First Name __________

• Last Name __________

• Company Name __________

• Job Title ______________

• Email Address ___________

• Phone number ____________

Thank you!

Statewide Cybersecurity Resources

Solicitation # BPM057598