RFP 250000010 - Statewide Cybersecurity Plan.pdf

STATE OF ALASKA

REQUEST FOR

PROPOSALS

OFFERORS ARE NOT REQUIRED TO RETURN THIS FORM.

IMPORTANT NOTICE: IF YOU RECEIVED THIS SOLICITATION FROM THE STATE OF ALASKA’S

“ONLINE PUBLIC NOTICE” WEB SITE, YOU MUST REGISTER WITH THE PROCUREMENT OFFICER

LISTED IN THIS DOCUMENT TO RECEIVE NOTIFICATION OF SUBSEQUENT AMENDMENTS. FAILURE

TO CONTACT THE PROCUREMENT OFFICER MAY RESULT IN THE REJECTION OF YOUR OFFER.

ISSUED BY:

DEPARTMENT OF MILITARY AND

VETERANS AFFAIRS

DIVISION OF ADMINISTRATIVE SERVICES

PRIMARY CONTACT:

JANNAH CAYETANO

PROCUREMENT OFFICER

MVADASPROCUREMENT@ALASKA.GOV

(907) 428-7222

STATEWIDE CYBERSECURITY PLAN

RFP 250000010

ISSUED MARCH 7, 2025

THE STATE OF ALASKA SEEKS TO UPDATE THE COMPREHENSIVE STATEWIDE CYBERSECURITY STRATEGIC

PLAN AIMED AT ENHANCING THE SECURITY, RESILIENCE, AND RESPONSE CAPABILITIES OF STATE SYSTEMS

AGAINST CYBERSECURITY THREATS.

mailto:MvaDasProcurement@alaska.gov

STATE OF ALASKA – REQUEST FOR PROPOSALS RFP 250000010

TABLE OF CONTENTS

INTRODUCTION & INSTRUCTIONS

SEC. 1.01 PURPOSE OF THE RFP

SEC. 1.02 BUDGET

SEC. 1.03 DEADLINE FOR RECEIPT OF PROPOSALS

SEC. 1.04 PRIOR EXPERIENCE

SEC. 1.05 REQUIRED REVIEW

SEC. 1.06 QUESTIONS PRIOR TO DEADLINE FOR RECEIPT OF PROPOSALS

SEC. 1.07 RETURN INSTRUCTIONS

SEC. 1.08 ASSISTANCE TO OFFERORS WITH A DISABILITY

SEC. 1.09 AMENDMENTS TO PROPOSALS

SEC. 1.10 AMENDMENTS TO THE RFP

SEC. 1.11 RFP SCHEDULE

SEC. 1.12 PRE-PROPOSAL TELECONFERENCE

SEC. 1.13 ALTERNATE PROPOSALS

SEC. 1.14 NEWS RELEASES

SECTION 2. BACKGROUND INFORMATION

SEC. 2.01 BACKGROUND INFORMATION

SECTION 3. SCOPE OF WORK & CONTRACT INFORMATION

SEC. 3.01 SCOPE OF WORK

SEC. 3.02 CONTRACT TERM AND WORK SCHEDULE

SEC. 3.03 DELIVERABLES

SEC. 3.04 CONTRACT TYPE

SEC. 3.05 PROPOSED PAYMENT PROCEDURES

SEC. 3.06 CONTRACT PAYMENT

SEC. 3.07 LOCATION OF WORK

SEC. 3.08 SUBCONTRACTORS

SEC. 3.09 JOINT VENTURES

SEC. 3.10 RIGHT TO INSPECT PLACE OF BUSINESS

SEC. 3.11 F.O.B. POINT

SEC. 3.12 CONTRACT PERSONNEL

SEC. 3.13 INSPECTION & MODIFICATION - REIMBURSEMENT FOR UNACCEPTABLE DELIVERABLES

SEC. 3.14 CONTRACT CHANGES - UNANTICIPATED AMENDMENTS

SEC. 3.15 NONDISCLOSURE AND CONFIDENTIALITY

SEC. 3.16 INDEMNIFICATION

SEC. 3.17 INSURANCE REQUIREMENTS

SEC. 3.18 TERMINATION FOR DEFAULT

SECTION 4. PROPOSAL FORMAT AND CONTENT

SEC. 4.01 RFP SUBMITTAL FORMS

SEC. 4.02 SPECIAL FORMATTING REQUIREMENTS

SEC. 4.03 OFFEROR INFORMATION AND CERTIFICATIONS (SUBMITTAL FORM A)

SEC. 4.04 EXPERIENCE AND QUALIFICATIONS (SUBMITTAL FORM B)

SEC. 4.05 UNDERSTANDING OF THE PROJECT (SUBMITTAL FORM C)

SEC. 4.06 METHODOLOGY USED FOR THE PROJECT (SUBMITTAL FORM D)

SEC. 4.07 MANAGEMENT PLAN FOR THE PROJECT (SUBMITTAL FORM E)

SEC. 4.08 COST PROPOSAL (SUBMITTAL FORM G)

SECTION 5. EVALUATION CRITERIA AND CONTRACTOR SELECTION

SEC. 5.01 SUMMARY OF EVALUATION PROCESS

SEC. 5.02 EVALUATION CRITERIA

SEC. 5.03 SCORING METHOD AND CALCULATION

SEC. 5.04 EXPERIENCE AND QUALIFICATIONS (15%)

SEC. 5.05 UNDERSTANDING OF THE PROJECT (15%)

SEC. 5.06 METHODOLOGY USED FOR THE PROJECT (10%)

SEC. 5.07 MANAGEMENT PLAN FOR THE PROJECT (10%)

SEC. 5.08 CONTRACT COST (COST PROPOSAL 40%)

SEC. 5.09 ALASKA OFFEROR PREFERENCE

SECTION 6. GENERAL PROCESS AND LEGAL INFORMATION

SEC. 6.01 INFORMAL DEBRIEFING

SEC. 6.02 ALASKA BUSINESS LICENSE AND OTHER REQUIRED LICENSES

SEC. 6.03 SITE INSPECTION

SEC. 6.04 CLARIFICATION OF OFFERS

SEC. 6.05 DISCUSSIONS WITH OFFERORS

SEC. 6.06 EVALUATION OF PROPOSALS

SEC. 6.07 CONTRACT NEGOTIATION

SEC. 6.08 FAILURE TO NEGOTIATE

SEC. 6.09 OFFEROR NOTIFICATION OF SELECTION

SEC. 6.10 PROTEST

SEC. 6.11 APPLICATION OF PREFERENCES

SEC. 6.12 ALASKA BIDDER PREFERENCE

SEC. 6.13 ALASKA VETERAN PREFERENCE

SEC. 6.14 ALASKA MILITARY SKILLS PROGRAM PREFERENCE

SEC. 6.15 STANDARD CONTRACT PROVISIONS

SEC. 6.16 QUALIFIED OFFERORS

SEC. 6.17 PROPOSAL AS PART OF THE CONTRACT

SEC. 6.18 ADDITIONAL TERMS AND CONDITIONS

SEC. 6.19 HUMAN TRAFFICKING

SEC. 6.20 RIGHT OF REJECTION

SEC. 6.21 STATE NOT RESPONSIBLE FOR PREPARATION COSTS

SEC. 6.22 DISCLOSURE OF PROPOSAL CONTENTS

SEC. 6.23 ASSIGNMENT

SEC. 6.24 FORCE MAJEURE (IMPOSSIBILITY TO PERFORM)

SEC. 6.25 DISPUTES

SEC. 6.26 SEVERABILITY

SEC. 6.27 SUPPLEMENTAL TERMS AND CONDITIONS

SEC. 6.28 SOLICITATION ADVERTISING

SEC. 6.29 FEDERALLY IMPOSED TARIFFS

SECTION 7. ATTACHMENTS

SEC. 7.01 ATTACHMENTS

INTRODUCTION & INSTRUCTIONS

SEC. 1.01 PURPOSE OF THE RFP

The Department of Military and Veterans Affairs, Division of Homeland Security and Emergency Management, is soliciting proposals to update the comprehensive Statewide Cybersecurity Strategic Plan aimed at enhancing the security, resilience, and response capabilities of state systems against cybersecurity threats.

SEC. 1.02 BUDGET

Department of Military and Veterans Affairs, Division of Homeland Security and Emergency Management, estimates a budget of between $100,000.00 and $150,000.00 dollars for completion of this project. Proposals priced at more than $150,000.00 will be considered non-responsive.

Payment for the contract is subject to funds already appropriated and identified.

SEC. 1.03 DEADLINE FOR RECEIPT OF PROPOSALS

Proposals must be received no later than 2:00 p.m. prevailing Alaska Standard Time on April 1, 2025, as indicated by postmark or email timestamp and late proposals will not be considered.

SEC. 1.04 PRIOR EXPERIENCE

In order for offers to be considered responsive offerors must meet these minimum prior experience requirements:

• Minimum of five (5) years of emergency planning with two (2) years of cybersecurity planning experience.

• The offeror must not have had a contract terminated for cause by the State within the last three years.

An offeror's failure to meet these minimum prior experience requirements will cause their proposal to be considered non-responsive and rejected.

SEC. 1.05 REQUIRED REVIEW

Offerors should carefully review this solicitation for defects and questionable or objectionable material.

Comments concerning defects and questionable or objectionable material should be made in writing and received by the procurement officer at least ten days before the deadline for receipt of proposals.

This will allow time for the issuance of any necessary amendments. It will also help prevent the opening of a defective proposal and exposure of offeror's proposals upon which award could not be made.

SEC. 1.06 QUESTIONS PRIOR TO DEADLINE FOR RECEIPT OF

PROPOSALS

All questions must be in writing and directed to the procurement officer. The interested party must confirm telephone conversations in writing.

Two types of questions generally arise. One may be answered by directing the questioner to a specific section of the RFP. These questions may be answered over the telephone. Other questions may be more complex and may require a written amendment to the RFP. The procurement officer will make that decision.

PROCUREMENT OFFICER: Jannah Cayetano – PHONE 907-428-7222 – TDD 711 – MvaDasProcurement@alaska.gov

SEC. 1.07 RETURN INSTRUCTIONS

If submitting a hard copy proposal, Offerors must submit one hard copy of their proposal to the procurement officer in a sealed package. The cost proposal included with the package must be sealed separately from the rest of the proposal and must be clearly identified. The sealed proposal package(s) must be addressed as follows:

Department of Military and Veterans Affairs Division of Administrative Services

Attention: Jannah Cayetano Request for Proposal (RFP) Number: 250000010

RFP Title: Cybersecurity Plan

If using U.S. mail, please use the following address:

PO BOX 5800

JBER, AK, 99505

If using a delivery service, please use the following address:

49000 ARMY GUARD ROAD STE. B105B

JBER, AK, 99505

If submitting a proposal via email, the technical proposal and cost proposal must be saved as separate PDF documents and emailed to MvaDasProcurement@alaska.gov as separate, clearly labeled attachments, such as “Vendor A – Technical Proposal.pdf” and “Vendor A – Cost Proposal.pdf”. The email must contain the RFP number in the subject line.

The maximum size of a single email (including all text and attachments) that can be received by the state is 20mb (megabytes). If the email containing the proposal exceeds this size, the proposal must be sent in multiple emails that are each less than 20 megabytes and each email must comply with the requirements described above.

Please note that email transmission is not instantaneous. Similar to sending a hard copy proposal, if you are emailing your proposal, the state recommends sending it with enough time to ensure the email is delivered by the deadline for receipt of proposals.

It is the offeror’s responsibility to contact the issuing agency at 907-428-7222 to confirm that the proposal has been received. The state is not responsible for unreadable, corrupt, or missing attachments.

SEC. 1.08 ASSISTANCE TO OFFERORS WITH A DISABILITY

Offerors with a disability may receive accommodation regarding the means of communicating this RFP or participating in the procurement process. For more information, contact the procurement officer no later than ten days prior to the deadline for receipt of proposals.

SEC. 1.09 AMENDMENTS TO PROPOSALS

Amendments to or withdrawals of proposals will only be allowed if acceptable requests are received prior to the deadline that is set for receipt of proposals. No amendments or withdrawals will be accepted after the deadline unless they are in response to the state's request in accordance with 2 AAC 12.290.

SEC. 1.10 AMENDMENTS TO THE RFP

If an amendment is issued before the deadline for receipt of proposals, the amendment will be posted on the State of Alaska Online Public Notice (OPN) website. The link to the posting of the amendment will be provided to all who were notified of the RFP and to those who have registered with the procurement officer after receiving the RFP from the OPN.

After receipt of proposals, if there is a need for any substantial clarification or material change in the RFP, an amendment will be issued. The amendment will incorporate the clarification or change, and a new date and time established for new or amended proposals. Evaluations may be adjusted as a result of receiving new or amended proposals.

SEC. 1.11 RFP SCHEDULE

RFP schedule set out herein represents the state’s best estimate of the schedule that will be followed.

If a component of this schedule, such as the deadline for receipt of proposals, is delayed, the rest of the schedule may be shifted accordingly. All times are Alaska Standard Time.

ACTIVITY TIME DATE

Issue Date / RFP Released N/A March 7, 2025 Pre-Proposal Conference 10:00 a.m. March 17, 2025 Deadline for Receipt of Proposals / Proposal Due Date 2:00 p.m. April 1, 2025 Anticipated Proposal Evaluations Complete N/A Week of April 7, 2025 Anticipated Notice of Intent to Award N/A Week of April 14, 2025 Anticipated Contract Issued N/A Week of April 28, 2025

This RFP does not, by itself, obligate the state. The state's obligation will commence when the contract is approved by the Commissioner of the Department of Military and Veterans Affairs, or the Commissioner's designee. Upon written notice to the contractor, the state may set a different starting date for the contract. The state will not be responsible for any work done by the contractor, even work done in good faith, if it occurs prior to the contract start date set by the state.

SEC. 1.12 PRE-PROPOSAL TELECONFERENCE

A pre-proposal teleconference will be held at 10:00 a.m., Alaska Time, on March 17, 2025. The purpose of the teleconference is to discuss the work to be performed with the prospective offerors and allow them to ask questions concerning the RFP. All questions raised during the meeting must be submitted in writing to the Procurement Officer and will be posted along with the answers on the Alaska Online Public Notice website as an Amendment to the RFP, as soon as possible after the meeting.

Offerors with a disability needing accommodation should contact the procurement officer prior to the date set for the pre-proposal conference so that reasonable accommodation can be made. To receive a meeting invitation, participants should contact the procurement office via email at MvaDasProcurement@alaska.gov at least 72 hours prior to the scheduled teleconference.

SEC. 1.13 ALTERNATE PROPOSALS

Offerors may only submit one proposal for evaluation. In accordance with 2 AAC 12.830 alternate proposals (proposals that offer something different than what is asked for) will be rejected.

SEC. 1.14 NEWS RELEASES

News releases related to this RFP will not be made without prior approval of the project director.

SECTION 2. BACKGROUND INFORMATION

SEC. 2.01 BACKGROUND INFORMATION

In 2023, the Statewide Cybersecurity Strategic Plan was set in place for the foundation of state-level cybersecurity efforts, providing a high-level roadmap for managing and mitigating cyber risks.

However, as cyber threats have become more complex, frequent, and sophisticated, it is evident that the strategic approach requires expansion and refinement. There has been a clear need to address not only cybersecurity risk management but also the mechanisms on responding to active incidents and sharing critical cybersecurity intelligence across government agencies and with external partners.

In response to the rapidly evolving landscape of cyber threats and the growing need for enhanced protection of state-level critical infrastructure, sensitive data, and services, the Statewide Cybersecurity Strategic Plan will be undergoing a significant update. This update aims to transform the original framework into a more robust, integrated, and proactive approach to cybersecurity. The revised plan will include the development of two key annexes—a Response Annex and an Intelligence and Information Sharing Annex—to ensure a comprehensive and coordinated state cybersecurity posture that addresses both current and future challenges.

SECTION 3. SCOPE OF WORK & CONTRACT INFORMATION

SEC. 3.01 SCOPE OF WORK

The Department of Military and Veterans Affairs, Division of Homeland Security and Emergency Management, is soliciting proposals to update the comprehensive Statewide Cybersecurity Strategic Plan aimed at enhancing the security, resilience, and response capabilities of state systems against cybersecurity threats. This plan will be augmented by a Response Annex and Intelligence, and Information Sharing Annex that provides detailed guidance on responding to specific incidents, ensuring rapid containment and recovery from cyber-attacks. This scope of work defines the objectives, approach, and deliverables for the update of the Statewide Cybersecurity Strategic Plan, Response Annex, and the Intelligence and Information Sharing Annex.

1. Project Objectives

• Update the Statewide Cybersecurity Strategic Plan to guide Alaska's agencies and organizations at all levels approach to preventing, detecting, and mitigating cyber threats, aligned with state and federal requirements, including State and Local Cybersecurity Grant Program Notice of Funding Opportunity requirements, Department of Homeland Security Cybersecurity and Infrastructure Security Agency planning guidance, and National Institute of Standards and Technology Cybersecurity Framework and accompanying guidance documents. Some specific guidance documents: National Cyber Incident Response Plan -December 2016; PUBL282.PS;

Security and Privacy Controls for Information Systems and Organizations and Computer Security Incident Handling Guide; NASCIO CyberDisruption 072016.pdf.

• Identify and prioritize risks, threats, and vulnerabilities affecting Alaska's digital assets and critical infrastructure.

• Define and integrate cybersecurity goals, objectives, and measurable benchmarks.

• Create a Response Annex that details protocols, processes, and roles for effective and timely response to cyber incidents.

• Create an Intelligence and Information Sharing Annex that establishes frameworks for real-time information exchange and interagency collaboration, both within Alaska and with external partners.

• Educate and train stakeholders on the strategic plan and annex protocols, enabling them to implement and follow cybersecurity policies effectively.

2. Scope of Services The scope of services for this project includes the following tasks:

Task 1: Project Planning and Kick-Off

• Conduct a kick-off meeting to establish the project's goals, scope, timeline, and expectations with state stakeholders.

• Assemble a project team including representatives from the State and Local Cybersecurity Grant Program (SLCSGP) Planning Committee, Alaska Cyber Group, emergency management, public safety, and relevant state departments.

• Develop a detailed project plan with timelines, roles, and responsibilities.

https://www.cisa.gov/sites/default/files/2023-01/national_cyber_incident_response_plan.pdf https://www.congress.gov/113/plaws/publ282/PLAW-113publ282.pdf https://csrc.nist.rip/csrc/media/projects/risk-management/800-53%20downloads/800-53r5/sp_800-53_v5_1-derived-oscal.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf https://www.nascio.org/wp-content/uploads/2019/11/NASCIO_CyberDisruption_072016.pdf

Task 2: Cybersecurity Risk Assessment

• Review the State of Alaska's existing cybersecurity posture, including policies, processes, and technologies.

• Identify critical assets, systems, and data across state agencies.

• Conduct a threat, risk, and vulnerability assessment to identify potential cybersecurity threats.

• Prioritize risks based on their likelihood and potential impact on state operations.

Task 3: Update of the Statewide Cybersecurity Strategic Plan

• Update strategic goals and objectives for cybersecurity that align with the state's overall mission and priorities.

• Outline a risk-based approach to cybersecurity investment and resource allocation.

• Detail policies and procedures that guide cybersecurity practices across all state agencies.

• Develop performance metrics and benchmarks to evaluate the effectiveness of cybersecurity initiatives.

• Update governance structure for ongoing cybersecurity management, including roles, responsibilities, and interagency collaboration.

• Review and update Annex W: Cybersecurity Incidents within the State Emergency Operations Plan to conform with the newly developed annexes.

Task 4: Cybersecurity Response Annex Development

• Develop a Response Annex to the Strategic Cybersecurity Plan, covering:

o Incident Response Protocols for different lines of effort to cyber incidents (e.g. threat response, asset response, intelligence support, and affected entity response).

o Roles and Responsibilities for state and agency-specific staff, emergency management teams, and external partners, including intrastate mutual aid system protocols and cyber incident resource request protocols and procedures.

o Communication and Notification Procedures to ensure rapid reporting, escalation, and information sharing.

o Containment, Eradication, and Recovery Protocols for limiting impact and ensuring business continuity.

o Threat Information Sharing and Coordination with federal and local agencies.

• Integrate tabletop exercises and simulations within the annex to test response protocols.

Task 5: Development of the Intelligence and Information Sharing Annex

• The Intelligence and Information Sharing Annex will be designed to enhance situational awareness and support coordinated response efforts across agencies.

This annex will include:

o Information Sharing Framework

Define protocols for sharing cyber threat information and intelligence across state, local, and federal levels, including private sector partners.

Establish communication channels and systems for sharing intelligence in real-time.

Designate roles and points of contact for existing ad hoc information sharing groups.

o Threat Intelligence Collection and Analysis

Identify types of data critical for proactive threat detection and situational awareness, such as Indicators of Compromise (IoCs) and emerging threat trends.

Set up a centralized intelligence database to catalog cyber threats and incidents, managed by the State Cybersecurity Office.

Develop a standardized process for collecting, analyzing, and disseminating threat intelligence.

o Interagency and Cross-Sector Collaboration

Formalize agreements with federal entities (e.g., DHS, FBI, CISA), neighboring states, local law enforcement, and private sector organizations.

Draft MOUs and SOPs that enable secure data sharing while protecting privacy and confidentiality.

Define collaborative response protocols for incidents affecting multiple agencies or sectors.

o Cyber Threat Intelligence Training and Drills

Implement training programs for agency personnel on interpreting and sharing cyber intelligence.

Organize tabletop exercises that simulate multi-agency threat intelligence sharing during a cyber-attack.

Task 6: Training and Stakeholder Engagement

• Conduct training sessions on the strategic plan and response annex for key stakeholders.

• Develop communication mate1ials and guides to ensure that staff understand and can implement cybersecurity protocols.

Task 7: Review and Approval

• Provide a draft update to the Statewide Cybersecurity Strategic Plan, Response Annex, and Intelligence and Information Sharing Annex to stakeholders for review.

• Incorporate feedback and make necessary revisions based on stakeholder input.

• Present the final plan and annex to the State of Alaska's Cybersecurity Planning

Committee for final approval.

Task 8: Maintenance and Periodic Updates

• Outline a process for annual review and update of the Statewide Cybersecurity Strategic Plan, Response Annex. and Intelligence and Information Sharing Annex.

• Develop a mechanism for continuous monitoring and assessment of the cybersecurity environment, allowing for agile responses to evolving threats.

3. Project Timeline The project is expected to take 6-9 months from the date of contract award, with the following preliminary milestones:

1. Kick-off meeting and project plan – Month 1

2. Risk Assessment Completion – Month 2

3. Draft Strategic Cybersecurity Plan – Month 5

4. Response and Intelligence Sharing Annex Development – Month 6

5. Stakeholder Review and Training – Month 7

6. Final Approval and Documentation – Month 8

4. Stakeholder Involvement and Responsibilities

The successful execution of the Statewide Cybersecurity Strategic Plan update and annex development will require collaboration across the following stakeholders:

• Alaska Cybersecurity Planning Committee – Final review and approval of updated Statewide Cybersecurity Strategic Plan.

• Alaska Cyber Group – Provide input on critical assets, review plan drafts, and participate in training.

• Agency Representatives – Provide input on critical assets, review plan drafts, and participate in training.

• Local, Regional, and Tribal Governments – Provide input on critical assets, review plan drafts, and participate in training.

• Public Safety and Emergency Management – Assist in response protocol development and coordinate with federal agencies as needed.

5. Evaluation and Success Metrics Success for this project will be determined by:

• Approval and adoption of the updated Statewide Cybersecurity Strategic Plan, Info1mation and Intelligence Sharing Annex, and Response Annex by Alaska Cybersecurity Planning Committee.

• Successful training, stakeholder engagement, and awareness campaign.

• Periodic improvements in incident detection, response time, and threat containment as evaluated annually.

This scope of work is intended to provide a comprehensive framework for creating a sustainable, responsive cybersecurity strategy that addresses both proactive and reactive needs for the State of Alaska.

SEC. 3.02 CONTRACT TERM AND WORK SCHEDULE

The length of the contract will be from the date of award, approximately week of April 28, 2025, for approximately 6-9 months until completion, approximately January 28, 2026.

Unless otherwise provided in this RFP, the State and the successful offeror/contractor agree: (1) that any extension of the contract excluding any exercised renewal options, will be considered as a month-to-month extension, and all other terms and conditions shall remain in full force and effect and (2) the procurement officer will provide notice to the contractor of the intent to cancel such month-to-month extension at least 30 days before the desired date of cancellation. A month-to-month extension may only be executed by the procurement officer via a written contract amendment.

SEC. 3.03 DELIVERABLES

The contractor will be required to provide the following deliverables:

1. Project Plan with milestones, timelines, and assigned roles and responsibilities.

2. Risk Assessment Report detailing c1itical assets, prioritized threats, and vulnerabilities.

3. Statewide Cybersecurity Strategic Plan encompassing strategic goals, policies, governance, and performance metrics. Include placeholder for Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA).

4. Cybersecurity Response Annex with detailed incident response protocols, communication procedures, and recovery processes.

5. Training Materials and educational resources on cybersecurity protocols.

6. Intelligence and Information Sharing Annex detailing threat info1mation-sharing frameworks, communication protocols, and collaboration guidelines.

7. Final Presentation and Approval meeting to confirm adoption of the Strategic Cybersecurity

Plan and Response Annex.

8. Annual Review Framework for ongoing evaluation and update of cybersecurity measures.

9. Any additional work products as specified in Section 3.01 SCOPE OF WORK

SEC. 3.04 CONTRACT TYPE

This contract is a firm fixed price contract.

SEC. 3.05 PROPOSED PAYMENT PROCEDURES

The state will make payments based on a negotiated payment schedule. Each billing must consist of an invoice and progress report. No payment will be made until the progress report and invoice has been approved by the project director.

SEC. 3.06 CONTRACT PAYMENT

No payment will be made until the contract is approved by the Commissioner of the Department of Military and Veterans Affairs or the Commissioner's designee. Under no conditions will the state be liable for the payment of any interest charges associated with the cost of the contract. The state is not responsible for and will not pay local, state, or federal taxes. All costs associated with the contract must be stated in U.S. currency.

Payment for agreements under $500,000 for the undisputed purchase of goods or services provided to a state agency, will be made within 30 days of the receipt of a proper billing or the delivery of the goods or services to the location(s) specified in the agreement, whichever is later. A late payment is subject to 1.5% interest per month on the unpaid balance. Interest will not be paid if there is a dispute or if there is an agreement that establishes a lower interest rate or precludes the charging of interest.

Any single contract payment of $1 million or higher must be accepted by the contractor via Electronic Funds Transfer (EFT).

SEC. 3.07 LOCATION OF WORK

The state will not provide workspace for the contractor. The contractor must provide its own workspace. All meetings can be conducted virtually via Microsoft Teams.

By signing their proposal, the offeror certifies that all services provided under this contract by the contractor and all subcontractors shall be performed in the United States.

If the offeror cannot certify that all work will be performed in the United States, the offeror must contact the procurement officer in writing to request a waiver at least 10 days prior to the deadline for receipt of proposals.

The request must include a detailed description of the portion of work that will be performed outside the United States, where, by whom, and the reason the waiver is necessary.

Failure to comply with these requirements may cause the state to reject the proposal as non-responsive or cancel the contract.

SEC. 3.08 SUBCONTRACTORS

Subcontractors will not be allowed.

SEC. 3.09 JOINT VENTURES

Joint ventures will not be allowed.

SEC. 3.10 RIGHT TO INSPECT PLACE OF BUSINESS

At reasonable times, the state may inspect those areas of the contractor's place of business that are related to the performance of a contract. If the state makes such an inspection, the contractor must provide reasonable assistance.

SEC. 3.11 F.O.B. POINT

All goods purchased through this contract will be F.O.B. final destination. Unless specifically stated otherwise, all prices offered must include the delivery costs to any location within the State of Alaska.

SEC. 3.12 CONTRACT PERSONNEL

Any change of the project team members or subcontractors named in the proposal must be approved, in advance and in writing, by the project director and the procurement officer. Changes that are not approved by the state may be grounds for the state to terminate the contract.

SEC. 3.13 INSPECTION & MODIFICATION - REIMBURSEMENT FOR

UNACCEPTABLE DELIVERABLES

The contractor is responsible for the completion of all work set out in the contract. All work is subject to inspection, evaluation, and approval by the project director. The state may employ all reasonable means to ensure that the work is progressing and being performed in compliance with the contract. The project director or procurement officer may instruct the contractor to make corrections or modifications if needed in order to accomplish the contract’s intent. The contractor will not unreasonably withhold such changes.

Substantial failure of the contractor to perform the contract may cause the state to terminate the contract. In this event, the state may require the contractor to reimburse monies paid (based on the identified portion of unacceptable work received) and may seek associated damages.

SEC. 3.14 CONTRACT CHANGES - UNANTICIPATED AMENDMENTS

During the course of this contract, the contractor may be required to perform additional work. That work will be within the general scope of the initial contract. When additional work is required, the project director will provide the contractor a written description of the additional work and request the contractor to submit a firm time schedule for accomplishing the additional work and a firm price for the additional work. Cost and pricing data must be provided to justify the cost of such amendments per

AS 36.30.400.

The contractor will not commence additional work until the procurement officer has secured any required state approvals necessary for the amendment and issued a written contract amendment, approved by the Commissioner of the Department of Military and Veterans Affairs or the Commissioner's designee.

SEC. 3.15 NONDISCLOSURE AND CONFIDENTIALITY

Contractor agrees that all confidential information shall be used only for purposes of providing the deliverables and performing the services specified herein and shall not disseminate or allow dissemination of confidential information except as provided for in this section. The contractor shall hold as confidential and will use reasonable care (including both facility physical security and electronic security) to prevent unauthorized access by, storage, disclosure, publication, dissemination to and/or use by third parties of, the confidential information. “Reasonable care” means compliance by the contractor with all applicable federal and state law, including the Social Security Act and HIPAA. The contractor must promptly notify the state in writing if it becomes aware of any storage, disclosure, loss, unauthorized access to or use of the confidential information.

Confidential information, as used herein, means any data, files, software, information or materials (whether prepared by the state or its agents or advisors) in oral, electronic, tangible or intangible form and however stored, compiled or memorialized that is classified confidential as defined by State of Alaska classification and categorization guidelines provided by the state to the contractor or a contractor agent or otherwise made available to the contractor or a contractor agent in connection with this contract, or acquired, obtained or learned by the contractor or a contractor agent in the performance of this contract. Examples of confidential information include, but are not limited to: technology infrastructure, architecture, financial data, trade secrets, equipment specifications, user lists, passwords, research data, and technology data (infrastructure, architecture, operating systems, security tools, IP addresses, etc).

Additional information that the contractor shall hold as confidential during the performance of services under this contract include:

• Personal Identifiable Information (PII)

• Security Plans and Protocols

• System Architecture and Network Diagrams

• Vulnerability Assessments and Pen Testing Results

• Security Audit Information

• Incident Response Plans

• Communication Records Related to the Project

Upon the termination or expiration of this contract, or upon the state’s written request, the contractor shall immediately securely destroy or return to the state all confidential information in its possession or control, including all copies, reproductions, and all derivatives thereof.

If confidential information is requested to be disclosed by the contractor pursuant to a request received by a third party and such disclosure of the confidential information is required under applicable state or federal law, regulation, governmental or regulatory authority, the contractor may disclose the confidential information after providing the state with written notice of the requested disclosure ( to the extent such notice to the state is permitted by applicable law) and giving the state opportunity to review the request. If the contractor receives no objection from the state, it may release the confidential information within 30 days. Notice of the requested disclosure of confidential information by the contractor must be provided to the state within a reasonable time after the contractor’s receipt of notice of the requested disclosure and, upon request of the state, shall seek to obtain legal protection from the release of the confidential information.

The following information shall not be considered confidential information: information previously known to be public information when received from the other party; information freely available to the general public; information which now is or hereafter becomes publicly known by other than a breach of confidentiality hereof; or information which is disclosed by a party pursuant to subpoena or other legal process and which as a result becomes lawfully obtainable by the general public.

SEC. 3.16 INDEMNIFICATION

The contractor shall indemnify, hold harmless, and defend the contracting agency from and against any claim of, or liability for error, omission, or negligent act of the contractor under this agreement. The contractor shall not be required to indemnify the contracting agency for a claim of, or liability for, the independent negligence of the contracting agency. If there is a claim of, or liability for, the joint negligent error or omission of the contractor and the independent negligence of the contracting agency, the indemnification and hold harmless obligation shall be apportioned on a comparative fault basis.

“Contractor” and “contracting agency”, as used within this and the following article, include the employees, agents and other contractors who are directly responsible, respectively, to each. The term “independent negligence” is negligence other than in the contracting agency’s selection, administration, monitoring, or controlling of the contractor and in approving or accepting the contractor’s work.

SEC. 3.17 INSURANCE REQUIREMENTS

Without limiting contractor's indemnification, it is agreed that contractor shall purchase at its own expense and maintain in force at all times during the performance of services under this agreement the following policies of insurance. Where specific limits are shown, it is understood that they shall be the minimum acceptable limits. If the contractor's policy contains higher limits, the state shall be entitled to coverage to the extent of such higher limits.

Certificates of Insurance must be furnished to the procurement officer prior to beginning work and must provide for a notice of cancellation, non-renewal, or material change of conditions in accordance with policy provisions. Failure to furnish satisfactory evidence of insurance or lapse of the policy is a material breach of this contract and shall be grounds for termination of the contractor's services. All insurance policies shall comply with and be issued by insurers licensed to transact the business of insurance under AS 21.

Workers' Compensation Insurance: The contractor shall provide and maintain, for all employees engaged in work under this contract, coverage as required by AS 23.30.045, and where applicable, any other statutory obligations including but not limited to Federal U.S.L. & H. and Jones Act requirements. The policy must waive subrogation against the State.

Commercial General Liability Insurance: covering all business premises and operations used by the Contractor in the performance of services under this agreement with minimum coverage limits of $300,000 combined single limit per claim.

Commercial Automobile Liability Insurance: covering all vehicles used by the contractor in the performance of services under this agreement with minimum coverage limits of $300,000 combined single limit per claim.

Professional Liability Insurance: covering all errors, omissions, or negligent acts in the performance of professional services under this agreement. Limits required per the following schedule:

Contract Amount Minimum Required Limits

Under $100,000 $300,000 per Claim/Annual Aggregate $100,000-$499,000 $500,000 per Claim/Annual Aggregate $500,000-$999,999 $1,000,000 per Claim/Annual Aggregate $1,000,000 or over Refer to Risk Management

SEC. 3.18 TERMINATION FOR DEFAULT

a. If the Project Director or Procurement Officer determines that the contractor has refused to perform the work or has failed to perform the work with such diligence as to ensure its timely and accurate completion, the state may, by providing written notice to the contractor, terminate the contractor's right to proceed with part or all the remaining work.

b. The Procurement Officer may also, by written notice, terminate this contract under Administrative Order 352 if the contractor supports or participates in a boycott of the State of Israel.

This clause does not restrict the state's termination rights under the contract provisions of Appendix A, attached in SECTION 7. ATTACHMENTS.

SECTION 4. PROPOSAL FORMAT AND CONTENT

SEC. 4.01 RFP SUBMITTAL FORMS

This RFP contains Submittal Forms, which must be completed by the offeror and submitted as part of their proposal. An electronic copy of the forms is posted along with this RFP.

Unless otherwise specified in this RFP, the Submittal Forms shall be the offeror’s entire proposal. Do not include any marketing information in the proposal.

Any proposal that does not follow these requirements may be deemed non-responsive.

SEC. 4.02 SPECIAL FORMATTING REQUIREMENTS

The offeror must ensure that their proposal meets all special formatting requirements identified in this section.

Documents and Text: All attachment documents must be written in the English language, be single sided, and be single spaced with a minimum font size of 10. Pictures or graphics may be used if the offeror feels it is necessary to communicate their information, however, be aware of the below requirements for page limits.

Page Limits: Some Submittal Forms listed below have maximum page limit requirements.

Offerors must not exceed the maximum page limits. Note, the page limit applies to the front side of a page only (for example, ‘1 Page’ implies that the offeror can only provide a response on one side of a piece of paper). Any pages exceeding the maximum page limit will be discarded and will not be included in the evaluations (for example, the maximum page limit is 3 pages, but the Offeror submits 5 pages for that submittal form. Only pages 1-3 will be evaluated. Pages 4 and 5 would be discarded by the Procurement Officer before sending to the proposal evaluation committee for evaluation.).

Submittal Form Maximum Page Limits

Submittal Form A – Offeror Information and Certifications Submittal Form B – Experience and Qualifications 5 Submittal Form C – Understanding of the Project 5 Submittal Form D – Methodology Used for the Project 5 Submittal Form E – Management Plan for the Project 5

Submittal Form G – Cost Proposal 5

Any Submittal Form submitted as part of a proposal that is not compliant with the instructions above may be a basis for finding the proposal non-responsive and thus rejected.

SEC. 4.03 OFFEROR INFORMATION AND CERTIFICATIONS

(SUBMITTAL FORM A)

The offeror must complete and submit this Submittal Form. The form must be signed by an individual authorized to bind the offeror to the provisions of the RFP.

By signature on the form, the offeror certifies they comply with the following:

a) the laws of the State of Alaska;

b) the applicable portion of the Federal Civil Rights Act of 1964;

c) the Equal Employment Opportunity Act and the regulations issued thereunder by the federal government;

d) the Americans with Disabilities Act of 1990 and the regulations issued thereunder by the federal government;

e) all terms and conditions set out in this RFP;

f) a condition that the proposal submitted was independently arrived at, without collusion, under penalty of perjury; and

g) that the offers will remain open and valid for at least 90 days.

If any offeror fails to comply with [a] through [g] of this paragraph, the state reserves the right to disregard the proposal, terminate the contract, or consider the contractor in default.

The Submittal Form also requests the following information:

a) The complete name and address of offeror’s firm along with the offeror’s Tax ID.

b) Information on the person the state should contact regarding the proposal.

c) Names of critical team members/personnel.

d) Addenda acknowledgement.

e) Conflict of interest statement.

f) Federal requirements.

g) Alaska preference qualifications.

An offeror's failure to address/respond/include these items may cause the proposal to be determined to be non-responsive and the proposal may be rejected.

SEC. 4.04 EXPERIENCE AND QUALIFICATIONS (SUBMITTAL FORM B)

Offerors must provide detail on the personnel assigned to accomplish the work called for in this RFP;

illustrate the lines of authority; designate the individual responsible and accountable for the completion of each component and deliverable of the RFP.

Offerors must provide a narrative description of the organization of the project team and a personnel roster that identifies each person who will actually work on the contract along with their titles and location(s) where work will be performed.

Offerors must also provide reference names and phone numbers for similar projects the offeror’s firm has completed.

SPECIAL NOTE FOR ANONYMOUS SUBMISSIONS: This Submittal Form shall be kept anonymous and must not contain any names (use example word: “Title”, “Position”, “The Company”) that can be used to identify who the offeror is and cannot exceed the page limit (as described in Section 4.02). Proposals that do not adhere to the requirements of this note may be found non-responsive.

Offerors must provide resumes for those personnel with names and title that will be assigned to complete the project as a separate attachment to Submittal Form B.

SEC. 4.05 UNDERSTANDING OF THE PROJECT (SUBMITTAL FORM C)

Offerors must provide comprehensive narrative statements that illustrate their understanding of the requirements of the project and the project schedule.

SPECIAL NOTE FOR ANONYMOUS SUBMISSIONS: This Submittal Form shall be kept anonymous and must not contain any names (use example word: “Title”, “Position”, “The Company”) that can be used to identify who the offeror is and cannot exceed the page limit (as described in Section 4.02). Proposals that do not adhere to the requirements of this note may be found non-responsive.

SEC. 4.06 METHODOLOGY USED FOR THE PROJECT (SUBMITTAL

FORM D)

Offerors must provide comprehensive narrative statements that set out the methodology they intend to employ and illustrate how the methodology will serve to accomplish the work and meet the state’s project schedule.

SPECIAL NOTE FOR ANONYMOUS SUBMISSIONS: This Submittal Form shall be kept anonymous and must not contain any names (use example word: “Title”, “Position”, “The Company”) that can be used to identify who the offeror is and cannot exceed the page limit (as described in Section 4.02). Proposals that do not adhere to the requirements of this note may be found non-responsive.

SEC. 4.07 MANAGEMENT PLAN FOR THE PROJECT (SUBMITTAL

FORM E)

Offerors must provide comprehensive narrative statements that set out the management plan they intend to follow and illustrate how the plan will serve to accomplish the work and meet the state's project schedule.

SPECIAL NOTE FOR ANONYMOUS SUBMISSIONS: This Submittal Form shall be kept anonymous and must not contain any names (use example word: “Title”, “Position”, “The Company”) that can be used to identify who the offeror is and cannot exceed the page limit (as described in Section 4.02). Proposals that do not adhere to the requirements of this note may be found non-responsive.

SEC. 4.08 COST PROPOSAL (SUBMITTAL FORM G)

Offerors must complete and submit this Submittal Form. Proposed costs must include all direct and indirect costs associated with the performance of the contract, including, but not limited to, total number of hours at various hourly rates, direct expenses, payroll, supplies, overhead assigned to each person working on the project, percentage of each person's time devoted to the project, and profit. The costs identified on the cost proposal are the total amount of costs to be paid by the state. No additional charges shall be allowed.

SECTION 5. EVALUATION CRITERIA AND CONTRACTOR

SELECTION

SEC. 5.01 SUMMARY OF EVALUATION PROCESS

The state will use the following steps to evaluate and prioritize proposals:

1) Proposals will be assessed for overall responsiveness. Proposals deemed non-responsive will be eliminated from further consideration.

2) A proposal evaluation committee (PEC), made up of at least three state employees or public officials, will evaluate the Technical portion of all responsive proposals.

3) The Submittal Forms, from each responsive proposal, will be sent to the PEC. No cost information will be shared or provided to the PEC.

4) The PEC will independently evaluate and score the documents based on the degree to which they meet the stated evaluation criteria.

5) After independent scoring, the PEC will have a meeting, chaired by the procurement officer, where the PEC may have a group discussion prior to finalizing their scores.

6) The evaluators will submit their final individual scores to the procurement officer, who will then compile the scores and calculate awarded points as set out in Section 5.03.

7) The procurement officer will calculate scores for cost proposals as set out in Section 5.08 and add those scores to the awarded points along with factoring in any Alaska preferences.

8) The procurement officer may ask for best and final offers from offerors susceptible for award and revise the cost scores accordingly.

9) The state will then conduct any necessary negotiations with the highest scoring offeror and award a contract if the negotiations are successful.

SEC. 5.02 EVALUATION CRITERIA

Proposals will be evaluated based on their overall value to state, considering both cost and non-cost factors as described below. Note: An evaluation may not be based on discrimination due to the race, religion, color, national origin, sex, age, marital status, pregnancy, parenthood, disability, or political affiliation of the offeror.

Overall Criteria Weight Responsiveness Pass/Fail

Qualifications Criteria Weight Experience and Qualifications (Submittal Form B) 15 Understanding of the Project (Submittal Form C) 15 Methodology Used for the Project (Submittal Form D) 10 Management Plan for the Project (Submittal Form E) 10

Total

Cost Criteria Weight Cost Proposal (Submittal Form G) 40 Total 40

Preference Criteria Weight Alaska Offeror Preference (if applicable) 10 Total 10

TOTAL EVALUATION POINTS AVAILABLE: 100

SEC. 5.03 SCORING METHOD AND CALCULATION

Each Proposal Evaluation Committee (PEC) member will individually evaluate and score each responsive proposal using the criteria and percentage values set out in Section 5. Each percentage value will equal one point, with the total maximum points awarded, per PEC member, for all evaluation sections not to exceed 100 points. Using only whole numbers, PEC members will start with a median score for each evaluation section. The score may either increase or decrease depending on the offeror’s response to each question for that section. As an example, if the Offeror provided responses over and above the evaluation questions in a section, they would receive a higher score. However, if the Offeror’s response fails to address all questions of a section or demonstrates some lack of understanding or competency as it relates to a question for that section, the Offeror would then receive a lower score.

SEC. 5.04 EXPERIENCE AND QUALIFICATIONS (15%)

This portion of the offeror’s proposal will be evaluated against the following questions:

1) Questions regarding the personnel:

a) Do the individuals assigned to the project have experience on similar projects?

b) Are resumes complete and do they demonstrate backgrounds that would be desirable for individuals engaged in the work the project requires?

c) How extensive is the applicable education and experience of the personnel designated to work on the project?

2) Questions regarding the firm and subcontractor (if used):

a) How well has the firm demonstrated experience in completing similar projects on time and within budget?

b) How successful is the general history of the firm regarding timely and successful completion of projects?

c) Has the firm provided letters of…