Request for Proposal.pdf

Atlanta Regional Commission

Homeland Security and Emergency Preparedness Department

Urban Area Security Initiative of Atlanta, Georgia

REQUEST FOR PROPOSAL

Multi-Jurisdictional, Cybersecurity Penetration Testing

INTRODUCTION

This regional project aims to provide cybersecurity penetration testing for jurisdictional members of the Atlanta Urban Area Security Initiative (UASI), specifically for the city of Atlanta and the counties of Clayton, Cobb, DeKalb, Fulton, and Gwinnett. The Atlanta Regional Commission (ARC) acts as the fiscal agent and the party responsible for this project. Funding is provided through ARC’s Homeland Security and Emergency Preparedness, which manages the Atlanta UASI with grant funds from the Grant Award Number: EMW-2024- SS-05208, (FY2024 DHS HSGP) under the Catalog of Federal Domestic Assistance (CFDA) Number:

97.067. The project's total cost shall not exceed ONE HUNDRED AND FIFTY THOUSAND DOLLARS ($150,000.00). Prior to services being performed, individual jurisdictions will present a refined Scope of Work (SOW), Attachment A, for the work requested in the respective exhibit. The successful vendor(s) should be prepared to begin work within ten (10) days of the fully signed contract. The successful vendor will conduct one (1) penetration test for each jurisdiction described (if desired) for the duration of the listed grant.

Vendor responses should include answers to the requirements listed for scoring purposes, and cost information must be provided. Vendors must include a sample penetration test report in their response to this Request for Proposal (RFP).

1. Operating Agency. Throughout this document, there will be references to the Operating Agency or its designee, which represents the jurisdictional members of the UASI. As such, the Operating Agency will identify and name an individual or group to assess their interest in the project. These “designees” shall be identified and named to the vendor after the award and before the start of the project.

2. Instructions. Vendors/Bidders responding to this proposal should adhere to the following additional instructions:

A. Interested firms must notify ARC by 5:00 PM EST Friday, November 21, 2025, if they intend to submit a proposal. ARC will email each interested firm or team of firms individually a link to a secure and confidential portal to upload the proposal. Interested firms should email uasi-rfq@atlantaregional.org. ARC must also receive one (1) hard copy via the address below and one copy through the secure and confidential portal set up for each interested firm. Please send your proposal via mail/delivery service with a tracking number. Please send the tracking information to uasi-rfq@atlantaregional.org. The proposal must be either in Microsoft Word or PDF format.

Proposals are due no later than 12:00 PM EST on Monday, November 24, 2025.

mailto:uasi-rfq@atlantaregional.org.

mailto:uasi-rfq@atlantaregional.org

Multi-Jurisdictional Cyber Security Penetration Testing

B. It is the Vendor/Bidder’s responsibility to check the ARC Procurement Website -https://atlantaregional.org/procurement/ for any addenda prior to submitting a final proposal.

C. The hard copy and digital copy received by ARC must be identical in content, and it is the responsibility of the vendor to ensure that the content matches. If conflicting copies are received, ARC will utilize the digital copy for the evaluation process.

D. The one (1) hard copy of the proposal must be submitted to the following address:

ATTN:

Ronald E. Brown, Sr.

c/o Atlanta Regional Commission- Homeland Security & Emergency Preparedness International Tower 229 Peachtree Street NE Suite 100 Atlanta, Georgia 30303

E. Proposals shall not exceed a total of 30 pages (8.5 x 11), inclusive of quotes, resumes, firm experience, covers, end sheets, and an introductory letter. Font size shall be a minimum of 11 points in all cases.

1. Cover letter / executive summary (1 page).

2. Responses to exhibits 1 through 7 (7 pages of yes/no questions).

3. Any additional description of services being offered (2 pages max).

4. Description of experience on similar projects to include at least five (5) references with current contact information (not to exceed five pages).

5. A sample penetration report (not to exceed 15 pages).

6. The following are not included in the page limitations listed above:

• Name of firm.

• Listing of key project personnel and their qualifications.

• Point of contact (name, title, phone number, mailing address, and email address).

• A description of the organization’s legal status, tax classification, FEIN/Contractor Tax ID

Number, and proof of the organization’s financial solvency; and

• Any other pertinent information.

F. Submit a Price Sheet in Word or Excel (does not count against the page limitation of this RFP).

1. Indicate your typical hourly rate (a range of rates is sufficient) for each person assigned to the project; and

2. The basis of the fees to be charged to the ARC and the estimated total cost for completing the assignment.

3. The total cost must include the initial penetration tests requested in all exhibits and two (2) additional annual tests, for each jurisdiction (if desired), as indicated in the introduction.

https://atlantaregional.org/procurement/

G. Qualified Service Area.

1. Indicate the personnel assigned to this work, if selected, and each person’s anticipated contribution. Please provide the individuals’ backgrounds to demonstrate that they have the experience to undertake the tasks they will be expected to do as part of the engagement.

H. The successful vendor or team of vendors should be prepared to sign a standard ARC contract for services, which contains required federal and state clauses. A copy of this boilerplate language is attached as Exhibit #6. The bidder's response should note any major reservations with this boilerplate agreement.

I. ARC reserves the right to award a contract based on this RFP to a vendor(s) based on initial proposals received without formal interviews and to award all or part of this project to one or more firms. If interviews are necessary, the short-listed firms will be invited to participate in an interview process with an evaluation committee.

J. To further assist prospective bidders in successfully proposing on this project, ARC will host a vendor/bidder conference virtually via Teams on Wednesday, November 5, 2025, at 1:00 p.m.

EST Information about the bidder’s conference is outlined below, along with this RFP’s schedule of milestones.

Issue Request for Proposal Wednesday, October 22, 2025

Technical Questions Received until Wednesday, October 29, 2025, (5:00 pm EST) to UASI- RFQ@atlantaregional.org.

Bidder’s Teleconference Wednesday, November 5, 2025, from 1:00 pm EST until 2:00 pm EST MICROSOFT TEAMS Join the meeting now Meeting ID: 262 841 004 898 8 Passcode: aZ95cN7M

Response to Technical Questions or Questions from Bidder’s Conference

Wednesday, November 12, 2025, Responses will be posted to ARC’s website.

Intent to Submit a Proposal Friday, November 21, 2025 (5:00 pm EST)

Proposals Due Monday, November 24, 2025 (12:00 pm EST)

3. Best Value. The ARC and the operating agency will select a vendor based on “best value.” The ARC and the Operating Agency shall solely determine the “Best Value” by evaluating each vendor proposal per the criteria described below.

4. Award Procedure. ARC reserves the right to make an award without further discussion of the qualifications and/or subsequent proposals received. Therefore, the qualifications must be submitted initially on the most favorable terms from both a technical and cost standpoint. After submission of the qualifications and closing thereof, no information will be released until the selection of vendor(s) is determined and the contract(s) are executed. ARC reserves the following rights: (1) to reject any or all qualifications received; (2) to decide to receive some, but not all, of the services requested in this RFP; and (3) that any qualified proposals submitted become part of the official file, without obligation or cost to the ARC.

5. Evaluation Criteria. The following are evaluation criteria. While negotiations may be held, vendors are advised to submit their most competitive Cost and Technical Responses.

mailto:RFQ@atlantaregional.org https://teams.microsoft.com/l/meetup-join/19%3ameeting_MjNmM2IyZWMtMmVmMC00ZDA1LTg2NzktNDk1ZTRjODBjY2Ey%40thread.v2/0?context=%7b%22Tid%22%3a%221efd81f5-9e53-4599-9ec3-76e7b5dbdf81%22%2c%22Oid%22%3a%2270c36315-969d-4d31-a2ab-e9bd2267b84a%22%7d

A. Technical approach to provide the requested services, including the quality/thoroughness of example reports

35%

B. Demonstration of expert qualifications and experience to perform requested services

30%

C. Reasonableness of fees and expenses 25%

D. References for the firm/organization, letters of support 10%

6. Subcontractors. Not permitted on this project.

7. Required Federal Clauses and Certifications. Vendors should note that all ARC-UASI solicitations and resulting contracts shall contain the following Federal Acquisition Regulations

(FAR) https://www.acquisition.gov/browsefar and other clauses as applicable:

A. Debarment and Suspension.

B. Conflict of Interest.

C. Lobbying, Certification, and Disclosure.

D. Sensitive Security Information.

E. Federal Civil Rights Laws and Regulations.

F. Federal EEO requirements.

G. Disadvantaged Business Enterprises/Small and Minority Firms and Women’s Business Enterprises.

H. Labor Requirements.

I. Environmental Protections.

J. Energy Conservation.

K. Georgia E-Verify.

L. Audit requirements.

https://www.acquisition.gov/browsefar

Exhibit #1

Vendor Mandatory Requirements

Vendors to this RFP are required to confirm by indicating “Yes” or “No” to their organization/firm’s ability to meet the requirements listed in Exhibit #1. The evaluation of responses will consist of a vendor’s adherence to completing all the Exhibits for the services.

NAME OF VENDOR:

For the Services below, confirm your organization’s offering with a “Yes” or “No.” Confirm

Organization must sign the CJIS Addendum https://gbi.georgia.gov/document/document/fbi-cjis- security-addendum/download.

Must store/transmit penetration test findings in encrypted formats

Must destroy penetration test findings at the conclusion of the test

Must perform a penetration test on location

Must be headquartered in the United States

Additional Requirements Confirm

Experience with Federal or State agencies or local governments serving more than 500,000 residents (include as references)

Minimum of 5 yrs. experience in business offering IT security assessment services

Must agree to a signed scope of work, which includes time and systems included in the test

Internal pen test teams should be able to perform on-site work at multiple locations.

Pen test services may involve work on, but not limited to, the following:

Mobile applications

Web applications

Cloud-hosted applications

Client images

Wireless Networks

Perform web testing from the following perspectives:

Unauthenticated user

Authenticated user

Administrative user

Evaluate the agency’s IT infrastructure at the network, system, and application levels.

The ability to test at a minimum of 5,000 internal IP addresses.

The ability to test at a minimum of 125 active external IP addresses.

Ability to locate all services and applications that exist within a provided subnet.

The vendor should be able to exploit all possible attack surfaces identified.

https://gbi.georgia.gov/document/document/fbi-cjis-security-addendum/download https://gbi.georgia.gov/document/document/fbi-cjis-security-addendum/download https://gbi.georgia.gov/document/document/fbi-cjis-security-addendum/download

Exhibit #1 (Continued)

For the Services below, confirm your organization’s offering with a “Yes” or “No.” Confirm

The vendor shall provide a methodology for accessing all the agency’s assets.

The vendor must communicate efficiently with the agency.

The vendor must be able to provide feedback on the customer's proposed remediation.

The vendor must complete all clean-up processes, including but not limited to:

Removal of accounts created as part of the assessment

Removal of tools installed by the tester on the agency’s systems

The ability to perform and complete all external and internal tests within 90 days of the signed contract.

Vendor shall not store any cardholder data if obtained during a penetration test.

Sign a non-disclosure agreement; the agency will retain a copy.

EXHIBIT #2

PENETRATION TESTING SERVICES FOR CITY OF ATLANTA

For the Services below, confirm your organization’s offering with a “Yes” or “No.”

NAME OF VENDOR:

Services Requested: Confirm

Application Testing

• Brute force (on designated systems)

• Password Cracking

• Public Information & Information Leakage

• Identification of OWASP Top 10 vulnerabilities

REQUIRED: Include a sample penetration test report in your response

EXHIBIT #3

PENETRATION TESTING SERVICES FOR CLAYTON COUNTY

For the Services below, confirm your organization’s offering with a “Yes” or “No.”

NAME OF VENDOR:

Services Requested: Confirm

Red Team Testing Social engineering tests done internally may include, but not limited to, the following methods:

• Phishing

• Spear Phishing

• Random calls

• Whaling

• Vishing

Physical Penetration Testing

• Dumpster Diving

• Badge cloning

• Tailgating

• Piggybacking

• Impersonation

• Network Access Control

• Public Information & Information Leakage

• Attempt to get users to plugin USB drivers or other media

Application Testing

• Brute force (on designated systems)

• Password Cracking

EXHIBIT #4

PENETRATION TESTING SERVICES FOR COBB COUNTY

Network Testing

• Brute force (on designated systems)

• Password Cracking

• Assessment of public routing policy

• Enumeration on public-facing DNS servers

• Assessment of internal network devices

• Denial of Service Identification

• VPN Endpoint Analysis

• Protocol Analysis of discovered protocols in use

• Determining which TCP/UDP ports are accessible

• Public Information & Information Leakage

• Password Service Strength Testing

• Public safety in-car communication systems

• Password Cracking

EXHIBIT #5

Page

PENETRATION TESTING SERVICES FOR DEKALB COUNTY

Application Testing

• Brute force (on designated systems)

• Password Cracking

EXHIBIT #6

PENETRATION TESTING SERVICES FOR FULTON COUNTY

Red Team Testing Social engineering tests done internally may include, but not limited to, the following methods:

• Phishing

• Spear Phishing

• Random calls

• Whaling

• Vishing

Network Testing

• Password Cracking

• Assessment of public routing policy

• Enumeration on public-facing DNS servers

• Assessment of internal network devices

• Denial of Service Identification

• VPN Endpoint Analysis

• Protocol Analysis of discovered protocols in use

• Determining which TCP/UDP ports are accessible

• Public Information & Information Leakage

• Password Service Strength Testing

• Public safety in-car communication systems

• Password Cracking

EXHIBIT #7

PENETRATION TESTING SERVICES FOR GWINNETT COUNTY

Application Testing

• Brute force (on designated systems)

• Password Cracking

Exhibit #8

CONSULTANT AGREEMENT

THIS AGREEMENT, entered into as of this day of 2023, by and between

(hereinafter referred to as the “Consultant”) and the Atlanta Regional Commission (hereinafter referred to as “ARC”).

WITNESSETH THAT:

WHEREAS, ARC desires to engage the Consultant to render certain services hereinafter described in connection with an undertaking or project (hereinafter referred to as the "Project") which is to be wholly or partially financed by a grant from the United States Department of Homeland Security (DHS) through the Georgia Emergency Management Agency and Homeland Security Agency (GEMA/HS), (hereinafter, along with the appropriate auditing agency of the entities making such grant, referred to as "the Concerned Funding Agencies"); and

WHEREAS, the Consultant desires to render such services in connection with the Project;

NOW, THEREFORE, in consideration of the premises and the mutual covenants and agreements hereinafter contained, the parties hereto agree as follows:

1. Engagement of the Consultant. ARC hereby agrees to engage the Consultant, and the Consultant hereby agrees to perform the services hereinafter set forth in accordance with the terms and conditions herein.

2. Scope of Services. The Consultant shall do, perform, and carry out in a satisfactory and proper manner, as determined by ARC, the work and services described in Attachment "A," which is attached hereto and made a part hereof.

3. Time of Performance. The services of the Consultant are to commence immediately upon execution of this agreement. Work and services shall be undertaken and pursued in such sequence as to assure their expeditious completion and as may be required in Attachment "A." All work and services required hereunder shall be completed within one-hundred (100) days of signed contract.

4. Compensation. The Consultant shall be compensated for the work and services to be performed under this agreement. Compensation for work and services in the performance of this contract shall not exceed $ .00.

5. Assignability. The Consultant shall not assign, sublet, or transfer all or any portion of its interest in this agreement without the prior written approval of ARC.

6. Amendments. ARC may require changes in this agreement. Except for termination for cause or convenience, such changes, including any increase or decrease in the amount of the Consultant's compensation, shall be incorporated in written amendments to this agreement. Amendments to this agreement may be executed on behalf of ARC only by ARC's Executive Director and Chairman.

7. Insurance. The Consultant will have and maintain insurance coverage that complies with the laws of the state of Georgia, as well as reasonable and prudent business practices. Such insurance shall at least include Worker’s Compensation, Public Liability, and Property Damage coverage.

DR

AF

T

8. Indemnification. To the extent permitted by law, the Consultant shall hold harmless and indemnify ARC, its officers, directors, and employees from and against losses, reasonable attorney fees, and costs that may be based on any injury to persons or property caused by the negligent performance of services under this agreement by the Consultant or any person employed by the Consultant.

9. Formal Communication. Formal communication regarding this agreement shall include, but not necessarily be limited to, correspondence, progress reports, and fiscal reports.

All formal communication regarding this agreement shall be in writing between the person executing this agreement on behalf of the Consultant (executor) and ARC's Executive Director. However, the Consultant executor and ARC’s Executive Director shall each have the right to designate in writing to the other an agent to act in his or her behalf regarding this agreement. Any restrictions to such designation must be clearly defined in the written designation.

In this regard, ARC’s Executive Director hereby designates the Manager of the Homeland Security and Recovery Group as his agent for purposes of this contract only, except for Amendments and Terminations.

10. Reports. The Consultant shall furnish ARC with narrative progress reports, in such form and frequency as may be specified by ARC's Executive Director or his authorized agent, outlining the work accomplished by the Consultant during the period, including the current status of the Project, and the percentage of work which has been completed.

11. Financial Reports. In addition to other records required by this contract, the Consultant agrees to provide to

ARC such additional financial reports in such form and frequency as ARC may require in order to meet ARC's requirements for reporting to the Concerned Funding Agencies.

12. Review and Coordination. To ensure adequate assessment of the Consultant's project and proper coordination among interested parties, ARC shall be kept fully informed concerning the progress of the work and services to be performed hereunder. The Consultant may be required to meet with designated representatives of ARC and the Concerned Funding Agencies from time to time to review the work and services performed. The Consultant shall be given reasonable written notice of such meetings.

13. Inspections. Authorized representatives of ARC and the Concerned Funding Agencies may at all reasonable times review and inspect the Project activities and data collected pursuant to this agreement. Except where specifically prohibited by law, all reports, studies, records, and computations prepared by or for the Consultant under this agreement shall be made available to authorized representatives of ARC and the Concerned Funding Agencies for inspection and review at all reasonable times in the Consultant's office where data is normally accumulated. Approval and acceptance of such material shall not relieve the Consultant of its professional obligation to correct, at its expense, any errors found in the work unless such errors can be shown to be caused by inaccurate or incomplete information provided by ARC.

14. Maintenance of Cost Records. The Consultant shall maintain all books, documents, papers, accounting records, and other evidence pertaining to costs incurred on the Project and shall make such material available at all reasonable times during the period of the agreement, and for three years from the date of final payment under the agreement, for inspection by ARC, the Concerned Funding Agencies, and if the work and services to be performed under this agreement is wholly or partially funded with federal funds, the Comptroller General of the United States, or any of their duly authorized representatives. The Consultant shall include the provisions of this paragraph in any subcontract executed in connection with this Project.

DR

15. No Obligation by the Federal Government. ARC and the Consultant acknowledge and agree that, not withstanding any concurrence by the Federal Government in or approval of the solicitation or award of the underlying contract, absent the express written consent by the Federal Government, the Federal Government is not a party to this contract and shall not be subject to any obligations or liabilities to ARC, the Consultant, or any other party (whether or not a party to that contract) pertaining to any matter resulting from the underlying contract.

16. Consultant's Personnel. The Consultant represents that it has, or will secure at its own expense, all personnel required to perform the services under this agreement. Such personnel shall not be employees of ARC, nor shall such personnel have been employees of ARC during any time within the twelve-month period immediately prior to the date of this agreement, except with the express prior written consent of ARC. Further, the Consultant agrees that no such former ARC employees shall be involved in any way with the performance of this agreement without the express prior written approval of ARC.

17. Employees' Rate of Compensation. The rate of compensation for work performed under this project by a staff member or employee of the Consultant shall not exceed the compensation of such person that is applicable to his or her other work activities for the Consultant. Charges for salaries and wages of individuals shall be supported by time and attendance and payroll distribution records.

18. Interest of Consultant. The Consultant covenants that neither the Consultant, nor anyone controlled by the

Consultant, controlling the Consultant, or under common control with the Consultant, nor its agents, employees, or Consultants, presently has an interest, nor shall acquire an interest, direct or indirect, which would conflict in any manner or degree with the performance of its service hereunder, or which would prevent, or tend to prevent, the satisfactory performance of the Consultant's service hereunder in an impartial and unbiased manner. The Consultant further covenants that in the performance of this agreement, no person having any such interest shall be employed by the Consultant as an agent, Consultant, or otherwise. If the Consultant contemplates taking some action which may constitute a violation of this paragraph, the Consultant shall request in writing the advice of ARC, and if ARC notifies the Consultant in writing that the Consultant's contemplated action will not constitute a violation hereof, then the Consultant shall be authorized to take such action without being in violation of this paragraph.

19. Interest of Members of ARC and Others. No officer, member, or employee of ARC, and no public official of any local government which is affected in any way by the project, who exercises any function or responsibilities in the review or approval of the project or any component part thereof, shall participate in any decision relating to this agreement which affects his or her personal interests or the interest of any corporation, partnership or association in which he or she is directly, or indirectly, interested; nor shall any such officer, member or employee of ARC, or public official of any local government affected by the project, have an interest, direct or indirect, in this agreement or the proceeds arising therefrom.

20. Officials Not to Benefit. No member of or delegate to the Congress of the United States of America, resident commissioner, or employee of the United States Government shall be admitted to any share or part of this agreement or to any benefits to arise herefrom.

21. Compliance with Requirements of the Concerned Funding Agencies. The Consultant shall be bound by the applicable terms and conditions of the Grant Contract between ARC and the Concerned Funding Agencies, which said Grant Contract is on file in the offices of ARC and is hereby made a part of this agreement as fully as if the same were attached hereto. ARC will notify the Consultant in writing of any applicable changes within a reasonable time after ARC has received appropriate notice of such changes from the Concerned Funding Agencies.

DR

22. Allowable Costs. In the case of a cost-reimbursable contract, the Consultant certifies that costs claimed for reimbursement under this contract shall not include costs incurred prior to the effective date or subsequent to the end date of this contract. The amount reimbursed under this contract shall be limited to the necessary and reasonable costs of employment, training, and other services provided according to the terms and conditions of this contract and the attachments hereto. In no event shall the allowable costs for any single line item of the budget attached hereto exceed the amounts shown for that line item therein, except as allowed under Attachment B. Reimbursement shall not be made to pay cost incurred for travel outside the state of Georgia unless approved in writing by ARC in advance for said travel; provided, further, that if travel inside or outside Georgia is approved, and said travel is to be by air, first class accommodations shall not be allowed. Mileage reimbursement is allowable and shall not exceed the IRS Standard Mileage Rate for Business.

23. Disallowed Costs. If costs incurred by the Consultant are not in conformity with the requirements of this contract and are subsequently disallowed as a result of a financial and compliance audit performed either pursuant to Audits herein below, by ARC, the concerned funding agency, the Comptroller General of the United States, or any of their duly authorized representatives, or otherwise, such costs shall be refunded to ARC from non-federal sources. ARC further reserves the right to withhold funds to recoup such improper or unauthorized disbursements. No finding of disallowed costs shall be made except after notice and opportunity for a fair hearing as provided in Disputes and Appeals herein below. Funds shall not be allowable under this contract for costs of entertainment. Contributions made on behalf of any participant to retirement systems or plans are not allowable under this contract. Further, funds shall not be allowable under this contract for payment of premiums for insurance policies which provide protection from debts against ARC, the state of Georgia, or the United States government.

24. Publicity. Articles, papers, bulletins, reports, or other material reporting the plans, progress, analysis, or results and findings of the work conducted under this agreement shall not be presented or published without first submitting the same to ARC for review and comment. No such presentation shall be made until comments have been received from ARC regarding such review; provided, however, if such comments have not been received by the Consultant within thirty calendar days after such submission, it shall be presumed that ARC has no objection thereto. ARC's comments, objections, reservations, or disagreements regarding such material shall be accommodated as ARC shall specify.

25. Assurances. The Consultant hereby assures and certifies that it will comply with the appropriate regulations, policies, guidelines, and requirements (as applicable), including, but not limited to, 2 CFR Part 200, “Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards,” 48 CFR 31, “Contract Cost Principles and Procedures,” Executive Order 12372, “Intergovernmental review of Federal programs,” U.S. Office of Management and Budget Circular Nos. A 21, “Cost Principles for Educational Institutions,” and A 133, “Audits of States, Local Governments and Non-Profit Organizations,” or other requirements imposed by ARC or the Concerned Funding Agencies concerning requirements of law or project matters as expressly made applicable by ARC herein, as they relate to the application, acceptance, use, and audit of federal funds for this federally assisted project. The provisions of 2 CFR 200.501 require a nonfederal entity that expends $750,000 or more in federal awards during its fiscal year must have a single or program-specific audit conducted for that year. Also, the Consultant gives assurance and certifies with respect to this agreement that: DR

a. For all agreements:

i. It understands that the phrase "federal financial assistance" includes any form of loan, grant, guaranty, insurance payment, rebate, subsidy, disaster assistance loan or grant, or any other form of direct or indirect federal assistance.

ii. It will comply with Title VI of the Civil Right Act of 1964 (P.L. 88-352 and 42 USC 2000d), and in accordance with Title VI of that Act, no person in the United States shall, on the ground of age, handicap, religion, creed or belief, political affiliation, sex, race, color, or national origin, be excluded from participation in, be denied the benefits of, or be otherwise subjected to discrimination under any project or activity for which the applicant receives federal financial assistance and will immediately take any measures necessary to effectuate this assurance. The Consultant shall take affirmative action to ensure that qualified applicants are employed, and qualified subcontractors are selected, and that qualified employees are treated during employment without regard to their age, handicap, religion, creed or belief, political affiliation, race, color, sex, or national origin. Such action shall include but not be limited to the following: employment, upgrading, demotions, or transfers; recruitment or recruitment advertising; layoffs or terminations; rates of pay or other forms of compensation; selection for training, including apprenticeship, and participation in recreational and educational activities.

The Consultant shall, in all solicitations or advertisements for subcontractors or employees placed by or on behalf of the Consultant, state that all qualified applicants will receive consideration for employment without regard to age, handicap, religion, creed or belief, political affiliation, race, color, sex, or national origin. The Consultant shall not discriminate against any qualified client or recipient of services provided through this agreement on the basis of age, handicap, religion, creed or belief, political affiliation, race, color, sex, or national origin. The Consultant shall cause the foregoing provisions to be included in all subcontracts for any work covered by this agreement so that such provisions will be binding upon each subcontractor.

The Consultant shall keep such records and submit such reports concerning the racial and ethnic origin of applicants for employment and employees as ARC, or the Concerned Funding Agencies, may require.

The Consultant agrees to comply with such rules, regulations, or guidelines as ARC or the Concerned Funding Agencies may issue to implement the requirements of this paragraph.

iii. It will comply with applicable requirements of the provisions of the Uniform Relocation Assistance and Real Property Acquisitions Act of 1970 (P.L. 91-646), which provides for fair and equitable treatment of persons displaced as a result of federal and federally assisted projects.

iv. It will comply with the applicable provisions of the Hatch Act, which limits the political activity of employees.

v. It will establish safeguards to prohibit employees from using their positions for a purpose that is or gives the appearance of being motivated by a desire for private gain for themselves or others, particularly those with whom they have family, business, or other ties. DR

vi. It will cooperate with ARC in assisting the Concerned Funding Agencies in this compliance with

Section 106 of the National Historic Preservation Act of 1966, as amended (16 U.S.C. 470), Executive Order 11593, and the Archeological and Historic Preservation Act of 1966 (16 U.S.C.

469a-1 et set.) by (a) consulting, through ARC, with the State Historic Preservation Officer on the conduct of investigations, as necessary, to identify properties listed in or eligible for inclusion in the National Register of Historic Places that are subject to adverse effects (see 36 CFR Part 800.8) by the activity, and notifying, through ARC, the Concerned Funding Agencies of the existence of any such properties, and by (b) complying with all requirements established by ARC or the Concerned Funding Agencies to avoid or mitigate adverse effects upon such properties.

vii. For agreements not involving federal financial assistance for construction, it will insure that the facilities under its ownership, lease, or supervision which shall be utilized in the accomplishment of the Project are not listed on the Environmental Protection Agency's (EPA) list of Violating Facilities and that it will notify the Concerned Funding Agencies, through ARC, of the receipt of any communication from the Director of the EPA Office of Federal Activities indicating that a facility to be used in the project is under consideration for listing by EPA.

viii. It will comply with Executive Order 11246, entitled "Equal Employment Opportunity," as amended by Executive Order 11375 and as supplemented in U.S. Department of Labor regulations (41 CFR Part 60).

ix. The Consultant agrees that throughout the performance of this contract, it will remain in full compliance with all federal and state immigration laws, including but not limited to provisions 8 USC 1324a and O.C.G.A. § 13-10-91 regarding the unlawful employment of unauthorized aliens and verification of lawful presence in the United States. Thereunder, Consultant will ensure that only persons who are citizens or nationals of the United States or non-citizens authorized under federal immigration laws are employed to perform services under this contract or any subcontract hereunder.

x. The Consultant agrees to comply with mandatory standards and policies relating to energy efficiency, which are contained in the state energy conservation plan issued in compliance with the Energy Policy and Conservation Act.

The Consultant further agrees to include the provisions contained in the foregoing paragraph in each subcontract for services hereunder.

The Consultant shall not retaliate or take any adverse action against any employee or any subcontractor for reporting or attempting to report a violation(s) of applicable immigration laws.

b. For agreements involving either full or partial federal financial assistance for construction projects(s):

i. It will comply with the provisions of Executive Order 11296, relating to the evaluation of flood hazards, and Executive Order 11288, relating to the prevention, control, and abatement of water pollution.

ii. It will require the facility to be designed to comply with the "American Standard Specifications for

Making Buildings and Facilities Accessible to and Usable by the Physically Handicapped," Number A1171-1961, as modified (41 CFR 101 - 17.703). The Consultant will be responsible for conducting inspections to ensure compliance by the Consultant with these specifications.

DR

c. For agreements exceeding $ 100,000.00 in federal financial assistance:

i. It will comply with all applicable standards, orders, or requirements issued under section 306 of the Clean

Air Act (42 U.S.C. 1857 (h), section 508 of the Clean Water Act (33 U.S.C. 1368), Executive Order 11738, and Environmental Protection Agency regulations (40 CFR Part 15).

26. Certifications.

a. Prohibition Against Use of Funds to Influence Legislation (Lobbying). No part of any funds under this agreement shall be used to pay the salary or expenses of any Consultant or agent acting for the Consultant to engage in any activity designed to influence legislation or appropriations pending before the Congress as stated in 49 CFR 20.

b. Debarment and Suspension. The Consultant agrees to comply with the non-procurement debarment and suspension rules in 49 CFR 29.

c. Drug-Free Workplace. The Consultant agrees and certifies that it will comply with the requirements for a Drug-Free Workplace, as described in Section 50-24-3 of the Official Code of Georgia, including passing through this requirement to lower tier Consultant.

d. The Consultant agrees and hereby certifies that it will comply with the Georgia Security and

Immigration Compliance requirements of O.C.G.A. § 13-10-91.

27. Termination for Mutual Convenience. ARC or the Consultant may terminate this agreement in whole or in part when both parties agree that the continuation of the project would not produce beneficial results commensurate with the further expenditure of funds. The two parties shall, through formal written amendment, agree upon the termination conditions, including the effective date and, in the case of partial termination, the portion to be terminated. The Consultant shall not incur new obligations for the terminated portion after the effective date and shall cancel as many outstanding obligations as possible. ARC shall evaluate each noncancelable obligation to determine its eligibility for inclusion in project costs. Settlement will be made in accordance with the terms and conditions of this agreement. ARC shall allow full credit to the Consultant for the ARC non-cancelable- cancelable obligations, properly incurred by the Consultant prior to termination.

28. Termination for Convenience. ARC may terminate this agreement, in whole or in part, at any time by giving written notice to the Consultant of such termination and specifying the effective date thereof at least fifteen days before the effective date of such termination. In that event, all information and material produced or collected under this agreement and/or used in the performance of the scope of services shall, at the option of ARC, become its property. If this agreement is terminated by ARC as provided in this paragraph, the Consultant will be reimbursed for the otherwise allowable actual expenses incurred by the Consultant up to and including the effective date of such termination, as authorized in Attachment "B." The Consultant shall not incur new obligations for the terminated portion after the effective date and shall cancel as many outstanding obligations as possible. ARC shall evaluate each noncancelable obligation to determine its eligibility for inclusion in project costs. DR

29. Termination of the Agreement for Cause. If the Consultant, due to its action or failure to act, shall fail to fulfill in a timely and proper manner its obligations under this agreement, or if the Consultant has or shall violate any of the covenants, agreements, representations, or stipulations of this agreement, ARC shall thereupon have the right to terminate this agreement by giving written notice to the Consultant of such termination and specifying the effective date thereof, at least five days before the effective date of such termination. In such event, all information and materials collected or produced under this agreement and/or used in the performance of the scope of services shall, at the option of ARC, become its property. The Consultant shall be entitled to receive just and equitable compensation for any satisfactory work completed under the Scope of Service up to and including the effective date of termination as authorized in Attachment "B."

Notwithstanding the foregoing to the extent provided by law, the Consultant shall not be relieved of liability to ARC for damages sustained by ARC by virtue of any breach of this agreement by the Consultant, and ARC may withhold any payments to the Consultant for the purpose of set-off for damages caused by the Consultant's breach until such time as the exact amount of damages to ARC from the Consultant is determined.

30. Termination Due to Non-Availability of Funds. Notwithstanding any other provision of this agreement, in the event that any of the funds for carrying out the functions to which this agreement relates do not become available, then, upon written notice to the Consultant, this agreement may be immediately terminated without further obligation of ARC.

31. Suspension Due to Non-Availability of Funds. The Concerned Funding Agencies have the right to suspend financial assistance for this project. Consequently, ARC reserves the same right regarding this agreement.

Such suspension would cause the withholding of further payments and/or prohibiting the Consultant from incurring additional obligations during the suspension period. However, unless notified in writing to the contrary, such suspension would not invalidate obligations otherwise properly incurred by the Consultant prior to the date of suspension to the extent that they are noncancelable.

Disputes and Appeals Any dispute concerning a question of fact arising either from a Consultant or Consultant selection decision or under a Consultant or Consultant contract, once executed, shall be decided by the cognizant Center Director who, after advisory consultation with all appropriate ARC officials (e.g., Director of Business Services, General Counsel, etc.) shall promptly reduce such decision concerning the question of fact to writing and mail, or otherwise furnish a copy thereof, to the disputing party (i.e., as appropriate, either:

the unsuccessful proposer; or the Consultant). The Center Director shall concurrently fully advise the disputing party, in writing, of the provisions outlined herein below concerning the disputing party's right to appeal the decision to the ARC Executive Director. A copy of all such documents shall also be furnished to the Director of Business Services.

The decision of the Center Director shall be final and conclusive unless, within ten (10) calendar days of receipt of such written decision, the disputing party mails or otherwise furnishes a written appeal concerning the question of fact to the ARC Executive Director, who shall arrange a formal hearing within twenty (20) calendar days after receipt of such appeal. Both the appealing party and the cognizant Center Director shall be notified no less than five (5) calendar days in advance of the hearing and shall have the right to present witnesses and give evidence concerning the question of fact at such time. Within twenty (20) calendar days after the hearing, the Executive Director shall make a decision concerning the question of fact in writing to the appealing party and to the cognizant Center Director. A copy of the decision shall also be furnished to the Director of Business Services. DR

The decision of the Executive Director concerning the question of fact shall be final and conclusive unless determined by the cognizant grantor agency or agencies, or the Comptroller General of the United States, or a court of competent jurisdiction to have been arbitrary, capricious, an abuse of discretion or otherwise not in accordance with the law.

Pending final decision of an appeal to the Executive Director under a Consultant or Consultant contract already executed, the Consultant or Consultant shall proceed diligently with the performance of the contract and in accordance with the cognizant Center Director's decision.

Nothing in the foregoing shall be construed as making final the decisions of the cognizant Center Director or the Executive Director as such decisions relate to a question of law.

32. Force Majeure. Any delay or nonperformance of any provisions of this Agreement caused by conditions beyond the reasonable control of the performing party shall not constitute a breach of this Agreement, provided that such party has made reasonable efforts to notify the other party in writing and makes reasonable efforts to resume performance once the condition interfering with or preventing performance is removed.

33. Waiver. The failure of ARC to insist upon strict performance of any of the provisions contained herein shall in no way constitute a waiver of future violations of the same or any other provision.

34. Authority. The individuals executing this Agreement on behalf of the Consultant and ARC do each hereby represent and warrant that they are duly authorized by all necessary action to execute this Agreement on behalf of their respective principals.

35. Applicable Law. This agreement shall be deemed to have been executed and performed in the State of

Georgia. All questions of interpretation and construction shall be construed by the laws of Georgia

36. Conflict of Interest and Confidentiality. Ownership of all data, materials and documentation prepared for and submitted to ARC in response to the RFP shall belong exclusively to ARC and will be considered a record prepared and maintained or received in the course of operations of a public office or agency and subject to public inspection in accordance with the Georgia Open Records Act, Official Code of Georgia Annotated, Section 50-18-70, et. seq., unless otherwise provided by law. Any information containing trade secrets or proprietary information, as defined by state law, must be marked as confidential to prevent disclosure. Confidential markings must be limited to the protected information. Entire proposals marked confidential will not be honored. Additionally, conflicts of interest are governed by the ARC Standards of Ethical Conduct available here:

https://atlantaregional.org/resources/standards-of-ethical-conduct/. Respondents must disclose any potential conflicts of interest that may arise from the provision of services described herein. Such disclosure should include the name of the individual(s) with whom there is a conflict, any relevant facts to the potential conflict, and a description of the internal controls proposed to mitigate any such conflict.

ARC's General Counsel will determine whether such disclosure presents a potential organizational conflict of interest that should preclude award to the respondent. DR

AF

https://atlantaregional.org/resources/standards-of-ethical-conduct/

IN WITNESS WHEREOF, the Consultant and ARC have executed this agreement as of the day first above written.

ATTEST NAME OF FIRM:

______________________________ By:_____________________________

Title:

ATTEST ATLANTA REGIONAL COMMISSION

Assistant Secretary Executive Director

Board Chairman

DR

ATTACHMENT A

SCOPE OF SERVICES

I. General: The work to be accomplished by the Contractor is in support of the following ARC Cost Center:

Cost Center No. Cost Center Title:

10.A.24.01 Cybersecurity

II. Purpose: The work to be accomplished by the organization(s) selected will be funded by Grant Award-

Number(s)- EMW-,2024-SS-05208, FY2024 DHS HSGP, UASI, and the Catalog of Federal Domestic Assistance (CFDA) Number: 97.067. This agreement includes applicable Federal, State, or local requirements.

III. Study Area: Within the UASI footprint (City of Atlanta, Clayton Co., Cobb Co., DeKalb Co., Fulton Co., Gwinnett Co.)

IV. Work and Services: The Contractor shall personally do, perform, and carry out satisfactorily and adequately, as determined by ARC, the procuring of items identified below to address:

The contractor must be able to perform penetration web testing from the following perspectives:

unauthenticated user, authenticated user, and administrative user. It must also evaluate the agency’s IT infrastructure at the network, system, and application levels. It must be able to test at least 5,000 internal IP addresses and 125 active external IP addresses, and locate all services and applications within a provided subnet. Ultimately, the contractor should be able to exploit all possible attack surfaces identified.

V. Deliverables: The Contractor/Vendor will procure the following items:

N/A