RFP 23-050 Cybersecurity Intrusion Detection Assessment - Instructions For Proposers Parts 1-4 with Exhibits - Final.pdf

SALEM AREA MASS TRANSIT DISTRICT (SAMTD)

Cybersecurity Intrusion Detection Assessment RFP No. 23-050

SALEM AREA MASS TRANSIT DISTRICT

REQUEST FOR PROPOSAL

RFP 23-050

CYBERSECURITY INTRUSION DETECTION ASSESSMENT

Date Issued: October 30, 2023

Pre-Proposal Conference: November 20, 2023 2:00PM PST (Mill Creek Conf. Rm.)

• Non Mandatory

Requests for Question Deadline: November 22, 2023 4:00PM PST

Response to Questions: November 29, 2023 5:00PM PST

Proposal Closes & Responses Due: December 12, 2023 4:00PM PST

Project Manager: Kristian Sorensen, Web Systems Administrator

Procurement Contact Daniel M. Knauss, Procurement & Contracts Manager

Submit Bid: Salem Area Mass Transit District Procurement & Contracts Department 555 Court Street NE, Suite 5230 Salem, Oregon 97301

TABLE OF CONTENTS

RFP 23-050

SECTION NO OF PAGES

1. RFP COVER PAGE……………………………………………………………………… 1

2. TABLE OF CONTENTS……………………………………………………………………1

3. PART 1 - INSTRUCTIONS FOR PROPOSER .……………………………………..… 9

4. PART 2 – SCOPE AND SPECIFICATIONS …………………………….…..……

5. PART 3 - EXHIBITS 1-14 – PROPOSAL FORMS .………….…..………………...… 19

6. PART 4 – EVALUATION OF PROPOSALS …………………………………………….5

7. EXHIBIT A – FTA CLAUSES ………..…………..……………………..………….……26

8. EXHIBIT B – FORM OF CONTRACT .…………………………………………………19

PART 1

INSTRUCTIONS FOR PROPOSER

SALEM AREA MASS TRANSIT DISTRICT

REQUEST FOR PROPOSAL (RFP)

RFP No. 23-050

Issue Date: October 30, 2023 Proposal Due: December 12, 2023 Time: 4:00 PM PST

SAMTD OVERVIEW

SALEM AREA MASS TRANSIT DISTRICT (SAMTD) is the public transportation agency operating fixed route, regional express, and paratransit service in the urban growth boundary of the Salem-Keizer area, as well as Marion and Polk counties. SAMTD services include Cherriots Local, Cherriots Regional, Cherriots LIFT (Paratransit service), Cherriots Shop and Ride, Travel Training, and Transportation Options, which promotes additional services such as carpool and vanpool matching.

SAMTD operates 64 local route buses, 43 paratransit buses (Cherriots LIFT), 15 regional buses Cherriots Regional), and five shopper shuttles. Most SAMTD services operate seven (7) days a week.

SAMTD Locations:

Administrative Offices General Manager, Finance, Customer Service, Marketing, Human Resources and part of the Operations Division are located at:

555 Court St N.E., Suite 5230 Salem, OR 97301

Operations, Contracted Services, and Maintenance Del Webb Facility 3140 Del Webb Ave.

Salem, OR 97301 The Del Webb facility also includes the parking area for buses not in service.

Keizer Transit Center 5860 Keizer Station Blvd., N.E.

Keizer, OR 97303

SECTION 1: INTRODUCTION

SAMTD is soliciting Proposals for services and equipment to fully assess and audit the security of all elements of the District’s technology environment, regardless of where it operates. SAMTD’s goal is to have a comprehensive and detailed review of the current environment, and then the creation of a Cyber Resilience / Recovery Program (CRP), as well as an implementation plan to improve its overall technology security posture.

A resultant contract will include the scope of services and specifications and all work as identified in PART 2 of this solicitation.

Successful Proposer shall be licensed by the State of Oregon to do the work required under this contract.

Successful Proposer shall obtain and maintain in current status all applicable permits and licenses.

For Scope and Specifications for this project, please see PART 2 of this RFP.

SECTION 2: PROJECT MILESTONES

• Notice To Proceed to successful contractor – February 1, 2024 (Estimate)

• Substantial contract completion by – July 31, 2024 (Estimate)

• Final contract completion by – August 31, 2024 (Estimate)

SECTION 3: INSTRUCTIONS TO PROPOSER

1. A. Proposal Submission Requirements

Response shall be submitted in a sealed envelope / container to the following address and clearly marked “RFP 23-050 Cybersecurity Intrusion Detection Assessment”.

Proposals must be submitted as follows:

1. One (1) original and three (3) copies of the response and proposal documents. One (1) copy must be unbound for ease of photocopy reproduction.

* See Item #7 below for acceptable alternative submission methods.

2. One (1) copy of the price proposal in a separate, sealed envelope marked, “Price Proposal.”

(See Exhibit 13 - Price Proposal Form)

3. One (1) electronic PDF format version of the response and proposal documents on a USB flash drive.

4. Digital signatures on forms are permitted.

5. Submit with a cover letter to:

Daniel M. Knauss Procurement & Contracts Manager Salem Area Mass Transit District 555 Court St., NE Suite 5230 procurement@cherriots.org

6. In the event of any conflicts between the hard copy and the electronic copy, the hard copy will prevail.

7. Alternative Submission Methods:

An email submission with electronic signatures submitted on or before the proposal close date and time will be accepted and considered a timely response to our solicitation.

SAMTD will also accept an electronic formatted version (thumb drive preferred) of the proposal documents, which are received at the SAMTD office on or before the proposal close date and time, and this submission will also be accepted and considered a timely response to our solicitation.

Additionally, SAMTD will also accept hard copy proposals that are received on or before the proposal close date, however an electronic formatted version is also required. Proposals delivered via US Mail can continue to be sent to the address identified in the solicitation.

8. Proposals must be received by SAMTD by 4:00 p.m., Pacific Time, December 12, 2023. Late submittals will not be considered.

B. Accommodation For People With Disabilities - People with disabilities who wish to request special accommodation, (e.g., sign language interpreters, Braille, etc.) need to contact SAMTD seven (7) working days prior to the scheduled proposal opening.

mailto:procurement@cherriots.org

C. Exceptions / Modifications To Scope Specifications - Proposer may not take exception to, or modify any part of, the Drawings (if applicable), Sample Contract Terms, or Specifications.

D. Right of Rejection / Cancellation and Irregularities - SAMTD reserves the right to reject any or all

Proposals, or part thereof, to accept one or more items of a proposal without obligation as to other items.

SAMTD reserves the right to cancel this RFP / solicitation at any time without liability prior to execution of a contract by SAMTD if it is in SAMTD’s or the public's best interest and is not liable for any costs the firm incurs while preparing or presenting the proposal. All Proposals will become part of the public file without obligation to SAMTD. SAMTD enforces the right to wave irregularities anytime through the solicitation process.

E. Late Proposals - Proposals submitted or received after the date and time indicated herein shall not be accepted without a prior extension of the closing date or time by SAMTD. Requests for extensions of the proposal closing date or time must be requested prior to the deadline for receipt of Proposer questions noted above. Timely requests will be considered, but SAMTD reserves the right to extend the due date or decline to extend the due date at its sole discretion.

F. One Proposal; Partial Proposals – A Proposer may not submit more than one (1) Proposal in response to this solicitation. No partially completed Proposals will be accepted and will be rejected if not properly completed based on the solicitation guidelines.

G. Single-Proposer Responsibility - Single-Proposer responsibility is required under this RFP. Each

Proposer responding to this RFP must propose all professional services/goods and provide all materials, equipment, supplies, transportation, freight, special services, and other work described or otherwise required herein for each project task.

H. Withdrawal or Modification of Proposals – Proposals shall not be modified after the closing date and time for Proposal submittal. Proposals may be withdrawn by Proposer before closing date and time as specified within this solicitation.

I. Requests for Clarification or Modification - All requests for clarification or modification of the RFP shall be made in accordance with Section 13 of this RFP.

J. Required Forms: If a form does not apply to your business or Proposal, please mark the form “Not Applicable.” Sign and date each form. Some forms may require notarization. Failure to complete all forms may result in the Proposal being ruled nonresponsive. Nonresponsive Proposals will not be evaluated or awarded a contract.

K. Addenda - Modifications to this RFP shall be made only by addenda to the solicitation. Verbal or faxed instructions, interpretations, and changes shall not serve as official expressions of SAMTD and shall not be binding. All cost adjustments or other changes resulting from said addenda shall be taken into consideration by Proposer and included in their Proposals. All addenda issued by SAMTD shall be acknowledged by Proposer on the Acknowledgement of Addenda form.

L. Experience and Qualifications (REQUIRED) – Proposer must demonstrate to the satisfaction of SAMTD that they possess the qualifications, experience, skill, licenses, necessary facilities, and financial resources required to perform the contract services in a satisfactory manner and within the required time.

1. Introduction or Cover Letter: Provide a brief introduction of the Proposer, and/or an introduction of all members who may be involved in the contract resulting from this RFP.

Describe primary business experience of the Proposer, length of time in business, organizational structure, size, capabilities, financial ability of Proposer to fulfill obligations of resultant contract award, ownership, the location of office(s), telephone number, email address, web-address, and any other information that the Proposer deems pertinent and introductory in nature.

2. Qualifications of Proposer: The Proposer shall describe its knowledge and past project experience relevant to SAMTD’s needs as listed in the Scope and Specifications in PART 2 of this RFP, including the Proposer’s direct experience on projects of similar size, scope and complexity.

M. Ambiguity in Specifications - Proposer shall promptly notify the SAMTD Procurement Manager at the address listed in Section 3, 1.A of this RFP, of any ambiguity, inconsistency, or error that it may discover upon examination of the Proposal documents within the time limits for Requests for Clarifications in Section 13.

N. DBE (Disadvantaged Business Enterprise): SAMTD has an overall agency goal of 2.43 percent for the utilization of DBEs using race neutral means. SAMTD strongly encourages and expects Proposer to pursue subcontracting, mentoring, joint venturing, teaming, and partnering opportunities with DBE firms in the ordinary course of its business/teaming strategies. Proposer are encouraged and expected to create a level playing field to the maximum practical extent, consistent with the objectives and requirements of the SAMTD DBE Program, which is based on federal regulations codified at 49 CFR Part 26. The DBE participation goal applies to the total value of the contract including the results of all pre-award negotiations and post-award change orders/modifications. SAMTD’s DBE Program and Policy may be accessed at www.Cherriots.org/en/about-us/procurement.

O. Substitution of Materials: BASE PROPOSAL MUST BE BASED UPON SPECIFIED MATERIALS.

Substitution of materials from those specified must be requested in accordance with the detailed requirements found in the Project Specifications. For the substitutions to be considered the Proposal Form must be accompanied by an alternate price and a detailed description, with drawings and manufacturer’s written specifications as may be necessary, on a separate form which fully describes the proposed alternate methods and materials.

P. Contractor’s License Law & Bond Requirements: Proposer shall comply with, and require all of their subcontractors to comply with Federal, State, County, and City contractor’s licensing laws, and be duly registered and licensed thereunder. Proposer shall provide a performance bond and a labor and material payment bond, each in the amount of (100%) of the subcontract price unless otherwise noted in the individual Proposal package.

Note: A Performance Bond and a Payment Bond is not required for this solicitation.

Q. Solicitation and Attachments – The Solicitation and any attachment or exhibit to this RFP will be incorporated into and made a part of the resulting Contract. In the event of a conflict between the provisions contained in the body of this RFP, the solicitation, and any attachment or exhibit, the terms in the body of the resulting Contract will control.

R. Waiver of Liens: The Proposer is responsible for the payment of all bills for labor and materials furnished by, or to, their subcontractors and itself. Upon presentation of the billing, subcontractor shall certify that they are submitting such lien waivers for all of their lower tier subcontractors and material suppliers that have furnished services or materials for the previous billing period. A Bond in lieu of Waivers will not be satisfactory.

S. Subcontractor’s Agreement: In submitting this Proposal, the Proposer hereby agrees, if awarded a Contract, to enter into and execute SAMTD’s standard form of contract agreement.

T. Value Engineering: Base Proposal MUST be based upon specified materials. However, Proposer are encouraged to submit value engineering cost Proposals for SAMTD review. These items can be submitted on the Proposal Form and clearly marked “Value Engineering Ideas”.

U. Protest: Duty to Exhaust Local Procedures. Once the Contractor exhausts SAMTD’s protest procedures, as described in applicable SAMTD Procurement Policy, the Contractor may request review from the FTA. Protests shall only be accepted from participating Proposer and must be submitted in writing and in a timely fashion, in accordance with SAMTD’s formal protest procedures. SAMTD’s formal protest procedures may be requested by contacting SAMTD Procurement by telephone at 503-588- 2424.

V. Certification: By submitting its Proposal, Proposer certifies that it is in compliance with the State of

Oregon statutory requirements governing registration of corporations and/or assumed business names.

Further, by submitting its Proposal, Proposer certifies that it is, and that its subcontractors are, in http://www.cherriots.org/en/about-us/procurement compliance with the State of Oregon statutory requirements governing registration of with the Oregon Construction Contractors Board.

W. Plan & Ability To Meet Scope & Specifications (Requirement): Provide a detailed description of proposers plan and ability to address and meet the scope and specification requirements of this RFP.

X. Pre-Contractual Expenses: Pre-contractual expenses are defined as expenses incurred by the firm in:

1) Preparing its proposal in response to the RFP;

2) Submitting that proposal to SAMTD;

3) Negotiating with any matter related to this proposal; and

4) Any other expenses incurred by the Proposer prior to the date of award, if any, of the proposed contract.

SAMTD shall not, in any event, be liable for any pre-contractual expenses incurred by Proposer in the preparation of their proposals.

Y. Supplements to Proposals:

1) If any proposal indicates minor noncompliance or variance with the RFP, SAMTD may, but need not, request that the proposal be supplemented.

2) If requested, the Proposer may submit a supplement to the proposal responsive to such a re-quest within the time-period established in such request, which SAMTD will receive and evaluate in conjunction with the proposal. Supplements shall not be Best and Final Offers unless so indi-cated.

Z. 1) Confidentiality: Prior to Contract award, SAMTD believes that the public interest will be harmed by disclosure of Proposals, Proposal supplements, and all communications made during procurement negotiations, and will hold all such documentation in confidence, until after Contract award, pursuant to ORS 192.502(4).

After Contract award, SAMTD will treat Proposals, Proposal supplements, and all communications made during procurement negotiations as a matter of public record, except to the extent they contain trade secrets, confidential information, or are otherwise exempt from disclosure under Oregon or fed-eral law.

To ensure appropriate confidentiality, Proposers must clearly and specifically identify confidential or trade secret information in their Proposals and must cite statutory or regulatory authority for exemption from public disclosure. SAMTD may find a waiver of confidentiality, if a proposer provides blanket-type identification by designating whole pages or sections, without more, as containing proprietary information, trade secrets or confidential commercial and financial information. In addition, SAMTD disclaims liability for inadvertent disclosure of trade secrets or other information entitled to confidential treatment, if the Proposer has failed to identify trade secrets or other confidential information clearly, has failed to cite statutory or regulatory authority for keeping such information confidential, or identifies an entire proposal or proposal supplement as confidential or exempt.

2) Procurement Confidentiality: Proposers are cautioned that until submission of their pro-posal, they may have contact concerning this RFP with only those SAMTD representatives, agents, or personnel designated in writing herein. Discussions or communications concerning this RFP with Source Evaluation Committee (SEC) Members, SAMTD Project Managers, SAMTD employees, its consultants, or members of the SAMTD Board of Directors, are strictly prohibited. Any violation of this restriction may result in disqualification of the Proposer from further participation in this procurement and from award of any contract or subcontract under this solicitation.

2. PREPARATION OF PROPOSAL

A. Proposals must be:

i. Submitted on the Proposal forms, or copies of forms, furnished by SAMTD, and

ii. Signed. If the Proposal is made by a corporation, it shall be signed by the corporation’s authorized designee.

iii. The address of the Proposer shall be typed or printed on the Proposal in the space provided.

B. The Proposal may require Proposer to submit prices for one or more items, including:

(1) lump sum proposal; (2) lump sum Proposal alternate prices; (3) unit prices; or (4) any combination of items (1) through (3) above.

C. SAMTD requires proposing on all items (including alternates and unit prices). Failure to do so may disqualify the proposal. If proposing on all items is not required by the specific proposal package documents, Proposer should insert the words “NO PROPOSAL” in the space provided for any item on which no price is to be submitted.

D. Proposer MUST comply with the requirements in the Proposal Documents. Modifying the proposal forms, conditioning or limiting the proposal, or offering to perform work not requested by the Proposal Documents may disqualify the proposal.

E. Proposer must submit the most recent two (2) years of audited financial statements. This information, along with the proposal documents, will be utilized to provide SAMTD information that will lead to a financial ability to perform determination. Private companies who may not have audited financial statements, can comply with this requirement by providing the most recent two (2) years of Financial Statements that may include P&L Statements, Income Statements, Balance Sheets, Tax Returns, and other company information that may help SAMTD make a financial ability to perform a resultant contract determination.

3. BASE PROPOSAL

The Proposer agrees to hold all pricing for period of one-hundred twenty (120) days from the date of the proposal closing.

4. ADDITIVE OR DEDUCTIVE PROPOSAL ITEMS

The Proposer agrees to hold all alternate and unit prices for one-hundred twenty (120) days from the date of the proposal closing.

5. SITE INVESTIGATION AND CONDITIONS AFFECTING THE WORK

By submitting this proposal, the Proposer acknowledges that it has taken steps necessary to ascertain the nature and location of the work, and that it has investigated and satisfied itself as to the general and local conditions which can affect the work or its cost, including but not limited to: (1) conditions bearing upon transportation, and disposal, handling, and storage of materials; (2) the availability of labor, material, equipment, water, electric power, and roadways; (3) uncertainties of weather, river stages, tides, ground water, or similar climatic and/or physical conditions that may have impact on the site; (4) the conformation and conditions of the ground; (5) the character of equipment and facilities needed preliminary to and during the work; (6) compliance with the project quality control program; and

(7) compliance with the Proposer’s safety plan as approved by SAMTD, and all applicable Occupational Safety and Health Administration (OSHA) regulations.

The Proposer also acknowledges that it has satisfied itself as to character, quality, and quantity of materials or obstacles to be encountered insofar as the information is reasonably ascertainable from an inspection of the site, as well as from the drawings, specifications and reports issued with this proposal package and to be made a part of this contract. Any failure of the Proposer to take the actions described and acknowledged in this paragraph will not relieve the Proposer from responsibility for estimating properly the difficulty and cost of successfully performing the work.

6. PROPOSAL AMOUNT

The Proposer acknowledges that the details of the specifications accurately reflect the Scope of the Work on which the Proposer is submitting its proposal. Proposer should base their proposal amounts on the following elements:

A. All labor, material, equipment, overhead, and compensation to complete all of the work under each particular heading as shown in the Proposal Documents at the time of proposal.

SAMTD is not subject to taxation; no federal or other taxes (excise, luxury, transportation, sales, etc.) shall be added to proposal amount.

7. PROPOSAL RESULTS

Following the issuance of the Notice of Intent to Award for any resulting Contract, SAMTD will provide the following information to interested parties upon timely request:

A. The number of Proposals SAMTD received;

B. The name of the successful Proposer; and C. A summary of the evaluations;

D. The total resulting contract price, including descriptions of items, quantities, and unit prices, if practical.

SAMTD will attempt to give notice under this paragraph promptly after Notice of Intent to Award.

SAMTD’s failure to give such notice shall not be deemed to affect the validity of the resulting contract.

8. CONTRACT AWARD

A. RESPONSIVENESS OF PROPOSAL

A proposal will be considered responsive if it meets the following requirements:

1. Is received at the proper date and time.

2. Meets the stated requirements of the proposal form.

3. Exhibits #1 - #14 under this solicitation are all completed and returned with the proposal.

4. The Contractor is licensed/registered within the State of Oregon at the time of proposal due date and is not banned from proposing by the Bureau of Labor and Industries.

5. The proposal is accompanied by a proposal guarantee, if required.

6. Complies with the State of Oregon and Federal requirements as applicable.

7. Demonstrated ability to comply with schedule.

8. Demonstrates performance of similar projects relative to size, schedule, etc.

9. Demonstrates the management resources and financial capacity to effect performance of the work.

B. APPARENT SUCCESSFUL PROPOSER

The apparent successful Proposer, for purpose of award, shall be the highest scoring responsive and responsible Proposer inclusive of additive or deductive proposal alternates and within the funds available for the project.

C. PROPOSAL SELECTION PROCESS

The successful Proposer shall be selected on the basis of having submitted a responsive and responsible proposal for this proposal package, other requirements established in PART 4, and other requirements of the proposal documents.

D. EFFECTIVE DATE OF THE CONTRACT

SAMTD will notify the successful Proposer and provide the successful Proposer with a written Notice of Intent to Award Contract. The successful Proposer shall return a signed copy of the Contract as well as all other documents required to be signed or provided such as bonds, insurance certificates, etc. The Contract will only become effective when all parties sign the contract and the Proposer provides all other documents required to be signed or provided such as bonds, insurance certificates, etc. Work performed and all costs incurred prior to SAMTD signature shall be the sole responsibility of the Proposer.

E. PAYMENT AND PERFORMANCE BONDS

Proposer must provide proposal, payment and performance bonds in their base price. Where indicated on the Proposal Form and according to the Bonding Requirements attached hereto provide a Deduct for removing requirements from Contract.

1. Proposal Bond Requirements (Construction)

Not required for this solicitation

2. Performance and Payment Bonding Requirements The successful Proposer shall be required to obtain performance and payment bonds as follows:

a. Performance bonds (Not required for this solicitation)

b. Payment bonds (Not required for this solicitation)

F. PROMPT PAY ACT

All Proposer must comply with the applicable Prompt Payment Act provisions, if selected. Failure to do so will be considered a material breach of contract.

9. MINIMUM WAGE AND PREVAILING WAGE REQUIREMENTS

10. APPLICABILITY OF RESULTING CONTRACT

11. PROPOSAL DOCUMENTS

The following documents form a part of and are included in the Proposal Documents:

A. Proposal Solicitation Documents Complete.

B. Scope, Drawings (if applicable), and Specifications for the Project.

C. Project Schedule Milestone Dates.

12. SCHEDULE OF PROPOSAL PROCEDURES

The anticipated project procurement timetable is as follows for Proposal Solicitation RFP #23-050 Cybersecurity Intrusion Detection Assessment:

Date Issued: October 30, 2023 Pre-Proposal Conference: November 20, 2023 2:00PM PST (Mill Creek Conf. Rm.)

* Non-Mandatory *

Requests for Question Deadline: November 22, 2023 4:00PM PST Response to Questions: November 29, 2023 5:00PM PST Proposal Closes: December 12, 2023 4:00PM PST

13. QUESTIONS, CLARIFICATIONS AND CHANGES TO RFP

SAMTD reserves the right to make changes to the RFP. All changes to the RFP, prior to the receipt of Proposals, shall be electronically distributed through addendum. Failure to acknowledge receipt of an addendum may cause a proposal to be rejected as non-responsive. Following receipt of proposal, any changes to SAMTD’s RFP will be conveyed in writing by SAMTD to the Proposer determined to be in the competitive range.

Proposer may submit questions, request clarification, or request a change to the RFP by submitting a written request to Daniel Knauss, Procurement & Contracts Manager at the address set forth above in Section 1.A(5) or via email procurement@cherriots.org. The request shall specify the provision of the RFP in question, and, if a change is requested, contain an explanation for the requested change. Where applicable, the Proposer is required to provide the value of each proposed modification and a brief explanation as to why the change is requested. Value shall be defined as any cost or savings to SAMTD and the advantage to SAMTD of the proposed change.

Questions, clarification requests, and /or RFP change requests must be received by November 22, 2023 at 4:00 PM Pacific Time. SAMTD will evaluate any question or request submitted, but reserves the right to determine whether to respond or accept the requested change.

Proposer shall not rely on oral or written representations regarding this RFP unless issued in writing as an addendum by the SAMTD Procurement & Contracts Department.

14. PRE-PROPOSAL CONFERENCE – NON-MANDATORY

A non-mandatory Pre-Proposal Conference will be held on November 20, 2023 at 2:00PM in person and via Teleconference. Suppliers who are considering proposing for this solicitation are strongly encouraged to attend. Statements made by SAMTD at the Pre-Proposal conference are not binding upon SAMTD unless confirmed by written Addendum.

• To attend in person and attend a site walk through:

Salem Area Mass Transit District Location: Mill Creek Conference Room Salem Area Mass Transit District 555 Court Street NE, Suite 5230

• To participate via teleconference:

To access via video:

https://meet.google.com/fqz-harw-ddu

To access via telephone:

(US)+1 320-803-0140

PIN: 615 433 660#

15. SITE VISITATION & VIEWING

Proposers may view the site areas where work is to be performed.

Proposers may submit requests to view the site where work is to be performed. Viewing may take place between the hours of 9:00AM – 3:00PM, Monday – Friday. Proposer must have an appointment scheduled in advance. If a Proposer arrives to view the site without a prior appointment, SAMTD may not accommodate the request. To schedule an appointment to view the site please contact:

Kristian Sorensen, Web Systems Administrator ……………….………… 503-361-7512

END OF PART 1

mailto:procurement@cherriots.org https://meet.google.com/fgr-tjdk-dkh?hs=122&authuser=0

PART 2

SCOPE OF SERVICES AND SPECIFICATIONS

1 Overview

1.1 Purpose

The Salem Area Mass Transit District (SAMTD or “the District”) has issued this Request for Proposal (RFP) to solicit responses from qualified technology security consulting firms (Contractor) offering proven Cyber Security Assessment services and the creation of Cyber Resilience / Recovery Programs and Implementa-tion Plans.

SAMTD seeks a qualified Contractor who can demonstrate organizational, functional, and technical capa-bilities, as well as the experience, expertise, and qualifications necessary to fully audit and assess the se-curity of the District’s current network and network/systems environment, as well as any cloud based in-stances that service the District of Public facing functions, and system environment. The Contractor shall create a detailed Cyber Resilience / Recovery Program (CRP) Implementation Plan to strengthen SAMTD’s technology security and that details the process to recover from a cyber-security incident.

1.2 Project Objectives

SAMTD intends to fully assess and audit the security of all elements of the District’s technology environ-ment, regardless of where it operates. The District’s goal is to have a comprehensive and detailed review of the current environment, and then the creation of a Cyber Resilience / Recovery Program (CRP), as well as an implementation plan to improve SAMTD’s overall technology security posture.

The Contractor shall use NIST Cybersecurity Framework to perform the assessment, including vulnerability assessments and penetration testing. A gap analysis shall be used to demonstrate the effectiveness of current District IT infrastructure, security, and resourcing to identify and mitigate potential risk vulnerabil-ities.

The gap analysis will outline security weaknesses versus best practices and applicable policies and laws.

Contractor is to provide the following:

• Threat level (high, medium, low)

• Level of effort to mitigate threat (high, medium, low)

• Recommendations to mitigate threats

Contractor’s response shall demonstrate an understanding of the subject matter and describe in detail the approach that will be taken to accomplish the services requested.

In addition, the Contractor will need to provide a framework for CRP along with a Cyber Security Imple-mentation Plan which together should include:

• Best Practices Guidance

• Needed technical configuration modifications

• Equipment

• Testing Plans

• Training

The implementation plan should be tied to meeting, at a minimum, the NIST Cybersecurity Framework.

2 Assessment and Testing Requirements The Cyber Security Assessment shall include, but not be limited to, a detailed review of the areas listed below. After completion, the Contractor will be expected to provide a report, and a presentation of findings.

The report shall address each item listed below and provide a summary of suggested remediation (if any).

Vulnerability assessments and penetration testing services will be used to identify and validate configura-tion and/or technical flaws within a given system or network (e.g. firewalls, routers, servers, operating sys-tems, applications, databases, etc.).

The Cyber Security Assessment shall include, but not be limited to, a detailed review of the areas listed below:

1. Policies, procedures and standards

2. Network Device Configurations

3. Network Architecture

4. Wireless Infrastructure and Configuration

5. Firewall Configuration

a. RDP Configuration

b. DMZ Configuration

6. Server Environment and Configurations

7. Hyper-V Virtual Environment

8. Data and Information Security

9. Mobile Devices

10. Desktop and Laptop Configurations

END OF PART 2

PART 3

PROPOSAL FORMS

EXHIBITS 1-14

SALEM AREA MASS TRANSIT DISTRICT EXHIBITS

The following items must be included in your proposal in order to receive consideration. Failure to complete all forms included in this package may result in your proposal being ruled nonresponsive.

Nonresponsive Proposals will not be considered for a contract award. Please sign and date each form and/or certification.

Proposer Sample Invoice (Please provide)

Proposer Financial Statements (Please provide)

Exhibit #1 – Proposal Form

Exhibit #2 – Acknowledgement of Addenda to RFP

Exhibit #3 – Non-Collusion Affidavit

Exhibit #4 – Organizational Conflict of Interest

Exhibit #5 - DBE Participation Commitment Statement

Exhibit #6 - DBE Letter of Intent

Exhibit #7 - DBE Affidavit

Exhibit #8 - DBE Unavailable Certification

Exhibit #9 - Contractor’s Representations & Warranties Certification

Exhibit #10 - Federal Debarment & Suspension Certificate

Exhibit #11 - Certification Regarding Lobbying

Exhibit #12 – Buy America Certification (Reserved)

Exhibit #13 – Price Proposal Form

Exhibit #14 – References

EXHIBIT #1

PROPOSAL FORM

The undersigned (“Proposer”), upon acceptance by SAMTD, agrees to furnish all labor, freight, transportation, materials, equipment, services, supplies, and other work in accordance with the Request for Proposal No. 23-050, entitled ”Cybersecurity Intrusion Detection Assessment,” as issued on October 30, 2023.

PROPOSER: The undersigned certifies as follows:

1. That he/she has read and understands all requirements and specifications of the Request For Proposal (RFP) (including any exhibits also posted); and

2. That he/she agrees to all requirements, specifications, terms, and conditions of the Solicitation referenced above; and

3. That he/she will furnish the designated item(s) and/or service(s) as Proposed in the Proposal; and

4. That he/she certifies under penalty of perjury that Proposer is, to the best of his/her knowledge, not in violation of any Oregon tax law; and

5. That his/her company has been certified as one of the following registered business classifications:

DBE ______ MBE _______ WBE _______ ESB _______ Veteran-Owned _______

Corporation ______ Other, identify: ______________________________________________

Resident Proposer (Oregon): _____ Yes _____ No

6. Federal Tax I.D. Number: D&B (Dun’s) Number:

Firm's Name:

Firm's Address:

Contact Person E-mail

Authorized Signature Date

Telephone Number Fax Number

Name of Project Manager and Title

7. Accounts Receivable Address, if different from above:

Proposer understands and agrees that, by his/her signature, if awarded the contract for the project, he/she is entering into a contract with SAMTD that incorporates the terms and conditions of the entire Request for Proposal package.

Proposer understands that this Proposal constitutes a firm offer to SAMTD that cannot be withdrawn for one-hundred twenty (120) calendar days from the date of the deadline for receipt of Proposals. If awarded the contract, Proposer agrees to deliver to SAMTD the required insurance certificates within ten (10) calendar days of the Notice of Award.

IMPORTANT: This form must be signed below by an authorized representative of the proposing firm, to authenticate the Proposal.

Authorized Signature: Date:

Printed Name:

Title:

EXHIBIT #2

ACKNOWLEDGMENT OF ADDENDA

The following form shall be completed and included in the Proposal.

Failure to acknowledge receipt of all addenda may cause the Proposer to be considered nonresponsive to the solicitation. Acknowledged receipt of each addendum must be clearly established and included with the Proposal.

The undersigned acknowledges receipt of the following addenda to the documents:

Addendum No. Dated

Addendum No. Dated Addendum No. Dated Addendum No. Dated Addendum No. Dated Addendum No. Dated Addendum No. Dated

Contractor Name:____________________________________________________

Signature of Authorized Representative:______________________________ ____

Printed Name:__________________________________Date:________________

Title/Position:_______________________ _______________

EXHIBIT #3

NON-COLLUSION AFFIDAVIT

I state that I am (the sole owner) (a partner) (an officer) (an agent) of ________________________, and that I am authorized to make this affidavit on behalf of my firm, and its owners, directors, and officers.

I am the person responsible in my firm for the price(s) and the amount of this offer.

I state that:

1. The price(s) and amount of this offer have been arrived at independently and without consultation, communication, or agreement with any other contractor, Proposer, or potential Proposer.

2. That neither the price(s) nor the amount of this Proposal, and neither the approximate prices(s) nor approximate amount of this Proposal, have been disclosed to any other firm or person who is a Proposer or potential Proposer, and they will not be disclosed before the Proposal opening/closing.

3. No attempt has been made or will be made to induce any firm or person to refrain from Proposing on this contract, or to submit a Proposal higher than this Proposal, or to submit any intentionally high or competitive Proposal or other form of complementary Proposal.

4. The Proposal of my firm is made in good faith and not pursuant to any agreement or discussion with, or inducement from, any firm or person to submit a complementary or other form of competitive Proposal.

5. , its affiliates, subsidiaries, officers, directors, and employees are not currently under investigation by any governmental agency and have not in the last four years been convicted of or found liable for any act prohibited by state or federal law in any jurisdiction, involving conspiracy or collusion with respect to Proposing on any public contract.

I state that understands and acknowledges that the above representations are material and important, and will be relied on by Salem Area Mass Transit District in awarding the contract(s) for which this Proposal is submitted. I understand and my firm understands that any misstatement in this affidavit is and shall be treated as fraudulent concealment from Salem Area Mass Transit District of the true facts relating to the submission of Proposals for this contract.

Signed Date _____________________________

Printed Name and Title ______________________________________________________

EXHIBIT #4

ORGANIZATIONAL CONFLICT OF INTEREST

AND AVOIDANCE / MITIGATION PLAN

This disclosure statement outlines potential organizational conflicts of interest, either real or apparent, which as a result of activities or relationships with other persons or entities, such person or entity:

1. Is unable or potentially unable to render impartial assistance or advice to Salem Area Mass Transit District; or

2. Is or might be otherwise impaired in its objectivity in performing the contract work; or

3. Has an unfair competitive advantage.

SECTION I. List potential organizational conflicts of interest. An organizational conflict of interest exists where other activities, relationships, or contracts of a contractor inhibit, affect, or prevent the contractor from rendering impartial assistance or advice to SAMTD; a contractor's objectivity in performing the contract work is or might be otherwise impaired (e.g., a contractor assisting with a design might have a financial interest in a product or system that could be utilized in implementing that design); or a contractor has an unfair competitive advantage which might be gained through its involvement in writing, or reviewing the solicitation and contract documents, including the scope or specification except as part of a general industry review.

SECTION II of this disclosure statement describes the management plan for avoiding or neutralizing the potential Organizational Conflicts of Interest as described in SECTION I of this disclosure statement. I acknowledge that Salem Area Mass Transit District may require revisions to the management plan described in SECTION II of this disclosure statement prior to approving it, and that Salem Area Mass Transit District has the right, in its sole discretion, to limit or prohibit my involvement in the Project as a result of the potential conflicts of interest described in SECTION I of this disclosure statement.

SECTION Ia – Name of Person or Firm Potentially Conflicted SECTION Ib – Current Project Name and Scope of Work SECTION Ic – Future Project Name and Description of Potential Conflict of Interest SECTION II - Plan for Managing Potential Conflicts of Interest

Signed Date _____________________________

Printed Name and Title ______________________________________________________

EXHIBIT #5

DISADVANTAGED BUSINESS ENTERPRISE (DBE) PARTICIPATION

COMMITMENT STATEMENT

AGENCY GOAL: 2.43%

SAMTD hereby notifies all Proposers that it is the policy of SAMTD to ensure nondiscrimination on the basis of race, color, sex, or national origin in the award and administration of contracts.

Proposers are urged to obtain Disadvantaged Business Enterprise (DBE) participation on this project, although there is no specific DBE contract goal for this project. Proposers are encouraged to attend any pre-Proposal conferences held to better understand the project and better obtain participation of DBE contractors, as applicable.

DBE GOAL: Proposal documents for all Federal Transit Administration-funded projects must contain a DBE policy statement advising Proposers that, as required by the Federal Transit Administration, SAMTD has established an overall DBE goal, and that SAMTD is required to report its DBE participation to FTA each year. As such, SAMTD is required to request information from contractors in order to fulfill its reporting responsibilities.

The Proposer's total DBE goal is the sum of the Proposer's proposed commitment to the goals for disadvantaged and women-owned firms. Proposers will calculate single goal percentages using the Proposer's proposed total dollar amount commitment to each single goal, divided by the Proposer's total amount of Proposal dollars. Goals will be calculated to the nearest one-one hundredth (0.01) of a percent.

Proposers must indicate the total DBE goal they propose to achieve. Even if the assigned contract goals are 0 percent, Proposers must fill in all blanks related to the Proposer's contract goals.

FAILURE TO DO SO MAY RENDER THE PROPOSAL NONRESPONSIVE.

PROPOSER`S CONTRACT GOALS:

TOTAL DBE GOAL %

The Proposers shall list all DBE subcontractors and their intended function for each phase of this contract. Monetary amounts shall be included beside each subcontractor that is identified to perform work on this contract. If there is no DBE participation, please note so in the space above.

By signing this statement, the Proposer assures that Good Faith Efforts have been made to meet the goal(s) for the DBE participation specified for this contract, and accepts the DBE Policy Statement on the next page.

Contractor Name:____________________________

Signature of Authorized Representative:____________

Printed Name:_______ Date:

Title/Position:

DISADVANTAGED BUSINESS ENTERPRISE POLICY STATEMENT

DBE POLICY: It is the policy of the United States Department of Transportation (DOT) and Salem Area Mass Transit District (SAMTD) that minority business enterprises, as defined in 49 CFR 26, shall have an equal opportunity to participate in the performance of contracts financed in whole or part with federal funds under this agreement. Consequently, the DBE requirements of 49 CFR 26 and FTA 4220.1F, as amended, apply to this agreement.

DBE OBLIGATION: SAMTD or its Contractor agrees to ensure that minority business enterprises, as defined in 49 CFR 26, have an equal opportunity to participate in the performance of contracts and subcontracts financed in whole or in part with Federal funds provided under this agreement. SAMTD and its Contractor shall take all necessary and reasonable steps in accordance with 49 CFR 26 to ensure that disadvantaged business enterprises (DBE) have an equal opportunity to compete for and perform contracts. SAMTD and its Contractor shall not discriminate on the basis of race, color, national origin, or sex in the award and performance of DOT-assisted contracts.

DBE APPLICABILITY: This applies to all projects and contracts financed by the Federal Transit Administration (FTA) or through the Oregon Department of Transportation (ODOT) without regard to the funding source. Recipients and Contractors shall conform to all applicable civil rights laws, orders, and regulations, including Section 504 of the Rehabilitation Act of 1973. Recipients and their Contractors shall not discriminate on the basis of race, age, sex, color, religion, national origin, mental or physical handicap, political affiliation, or marital status in the award and performance of ODOT contracts.

DBE CERTIFICATION: SAMTD will accept current certifications by the State of Oregon Office of Minority, Women and Emerging Small Business Enterprise Program (OMWESB). If a completed application for DBE certification has been submitted to the Office of Minority, Women and Emerging Small Business Enterprise Program (OMWESB) as of Proposal opening but has not been processed, the District may count the applicant’s participation toward achieving the DBE contract specific goal, assuming that the applicant’s certification application is approved prior to contract award. The DBE directory of certified firms is available on the Internet at:

https://oregon4biz.diversitysoftware.com/FrontEnd/VendorSearchPublic.asp?XID=6787&TN=oregon 4biz

This DBE Policy Statement shall be included in all subcontracts entered into under this contract.

GOOD FAITH EFFORTS: In addition to signing the DBE Participation Commitment Statement contained in the Proposal documents, the Proposer who has not achieved the assigned goal on this project shall document the steps taken to obtain participation. Failure to document and submit good faith efforts when the Proposer has not achieved the assigned goal shall render Proposal nonresponsive. Good faith efforts may include the following:

A. Attendance at a pre-Proposal meeting, if any, scheduled by SAMTD to inform the DBEs of subcontracting opportunities in this contract work;

B. Advertising in general circulation media, trade association publications, and minority-focus media at least ten (10) days before Proposals or Proposals are due. If ten (10) days are not available, a shorter reasonable time will be acceptable;

C. Use of the Oregon Department of Consumer & Business Services Certified DBE Directory;

D. Written notification to DBEs that their interest in the contract is solicited;

https://oregon4biz.diversitysoftware.com/FrontEnd/VendorSearchPublic.asp?XID=6787&TN=oregon4biz https://oregon4biz.diversitysoftware.com/FrontEnd/VendorSearchPublic.asp?XID=6787&TN=oregon4biz

E. Efforts to select portions of the work proposed to be performed to increase the likelihood of achieving the assigned goal;

F. Efforts to negotiate for specific sub-Proposals, including at a minimum:

a. The name, address, or telephone number of each DBE contacted;

b. A description of the information provided regarding the plans and specifications for the portions of the work to be performed;

c. A statement of why additional agreements were not reached;

d. Reasons for rejecting as unqualified any DBE contacted;

G. Efforts to provide assistance in obtaining any necessary bonding or insurance;

H. Efforts to use the service of banks owned and controlled by minorities or women;

I. Efforts to assist the DBE in purchasing materials and supplies; and

J. Any other affirmative action efforts

CONTRACT/SUBCONTRACT APPLICABILITY: DBE Program for Contracts Solicitation language shall require that contractors, including subcontractors, must meet all requirements of the DBE program as a matter of responsiveness.

A. Prompt Payment to Subcontractors: The prime contractor agrees to pay each subcontractor under this prime contract for satisfactory performance of its contract no later than thirty (30) days from the receipt of each payment the prime contractor receives from SAMTD. The prime contractor agrees further to return retainage payments to each subcontractor within thirty (30) days after the subcontractor’s work is satisfactorily completed. Any delay or postponement of payment from the above-referenced timeframe may occur only for good cause following written approval of SAMTD. This clause applies to both DBE and non-DBE subcontracts.

B. Contract Assurance Clause: SAMTD will ensure that the following clause is placed in every DOT-assisted contract and subcontract:

The contractor or subcontractor shall not discriminate on the basis of race, color, national origin, or sex in the performance of this contract. The contractor shall carry out applicable requirements of 49 CFR Part 26 in the award and administration of DOT-assisted contracts. Failure by the contractor to carry out these requirements is a material breach of this contract, which may result in the termination of this contract or such other remedy as the recipient deems appropriate.

EXHIBIT #6

DBE LETTER OF INTENT

(To be completed by each DBE)

To:…