REQUEST FOR PROPOSALS

RETURN THIS PROPOSAL TO:

DIVISION OF LEGISLATIVE AUDIT

Issuing Office Mailing Address: State Capitol, 120 4th Street, Room 3, Juneau, AK 99801-1182 Issuing Office Hand Delivery Address: Terry Miller Legislative Office Building, 129 6th Street, Room 222, Juneau, Alaska

RFP NO. 26-33-03

CYBER SECURITY ASSESSMENTS OF SELECT STATE IT SYSTEMS

SEALED PROPOSALS MUST BE RECEIVED AT THE ABOVE ADDRESS OR MUST

BE EMAILED TO LAA.PROCUREMENT@AKLEG.GOV BY 2:00 P.M. ALASKA TIME

ON MARCH 31, 2026.

Offerors Are Not Required To Return This Form

Under AS 36.30.020, the Alaska Legislative Council adopted procurement procedures that were based on competitive principles consistent with AS 36.30 and adapted to the special needs of the Legislative Branch. Therefore, the Legislative Branch follows its own procurement procedures and is not subject to the procurement procedures of the Executive Branch. Copies of the Alaska Legislative Procurement Procedures are available upon request or at https://aws.state.ak.us/OnlinePublicNotices/Notices/Attachment.aspx?id=137335.

IMPORTANT NOTICE: You must register with the Procurement Manager listed in this document to receive subsequent amendments to this Request for Proposals (RFP), whether you received this RFP from the State of Alaska’s “Online Public Notice” (OPN) website or another source. Failure to register with the Procurement Manager may result in the rejection of your proposal.

JC Kestel, Procurement Manager

PH: 907-465-6705

TDD: 907-465-4980

Email: LAA.Procurement@AKLeg.gov mailto:LAA.Procurement@AKLeg.gov https://aws.state.ak.us/OnlinePublicNotices/Notices/Attachment.aspx?id=137335 mailto:LAA.Procurement@AKLeg.gov

State of Alaska Cybersecurity Reviews of Division of Legislative Audit Select State Systems

RFP 26-33-03 Page 2 of 40 Issue Date: March 6, 2026

TABLE OF CONTENTS

INTRODUCTION AND INSTRUCTIONS

1.01 PURPOSE OF THE RFP

1.02 PROPOSAL SUBMISSION, DELIVERY, AND ACCEPTANCE

1.03 PHOTOCOPIES

1.04 CONTRACT TERM AND WORK SCHEDULE

1.05 LOCATION OF WORK

1.06 HUMAN TRAFFICKING

1.07 AMERICANS WITH DISABILITIES ACT

1.08 REVIEW OF RFP

1.09 QUESTIONS RECEIVED PRIOR TO DEADLINE FOR RECEIPT OF PROPOSALS

1.10 AMENDMENTS

1.11 NUMBER OF PROPOSALS; ALTERNATE PROPOSALS

1.12 RIGHT OF REJECTION

1.13 NON-AWARD OF CONTRACT

1.14 DISCLOSURE OF PROPOSAL CONTENTS

1.15 SUBCONTRACTORS

1.16 JOINT VENTURES

1.17 OFFEROR’S CERTIFICATION

1.18 CONFLICT OF INTEREST

1.19 PROJECT DIRECTOR

1.20 ASSIGNMENT/TRANSFER

1.21 BINDING ON SUCCESSORS

1.22 DISPUTE

1.23 VENUE AND APPLICABLE LAW

1.24 SEVERABILITY

1.25 PROCUREMENT PROCEDURES

1.26 RECORDS; AUDIT

1.27 MATERIALS AND PROCESSES COVERED BY PATENTS, TRADEMARKS, OR COPYRIGHTS

1.28 OWNERSHIP AND REUSE OF DOCUMENTS

1.29 COVERAGE UNDER THE ETHICS LAW

1.30 CANCELLATION OF SOLICITATION

STANDARD PROPOSAL INFORMATION

2.01 AUTHORIZED SIGNATURE

2.02 U.S. FUNDS

2.03 TAXES

2.04 AMENDMENTS TO PROPOSALS

2.05 SUPPLEMENTAL TERMS AND CONDITIONS

2.06 CLARIFICATION OF OFFERS

2.07 PRIOR EXPERIENCE

2.08 EVALUATION OF PROPOSALS

2.09 FEDERAL TAX ID

2.10 ALASKA BUSINESS LICENSE, LEGAL ENTITY AND OTHER REQUIRED LICENSES

2.11 ALASKA BIDDER PREFERENCE

2.12 FORMULA USED TO CONVERT COST TO POINTS

2.13 CONTRACT NEGOTIATION

2.14 NOTICE OF INTENT TO AWARD – OFFEROR NOTIFICATION OF SELECTION

2.15 PROTEST

RFP 26-33-03 Page 3 of 40 Issue Date: March 6, 2026

2.16 PRE-PROPOSAL TELECONFERENCE

STANDARD CONTRACT INFORMATION

3.01 FORMAT OF CONTRACT

3.02 CONTRACT APPROVAL

3.03 PROPOSAL AS A PART OF THE CONTRACT

3.04 ADDITIONAL TERMS AND CONDITIONS

3.05 APPLICABLE LAW

3.06 INSURANCE REQUIREMENTS

3.07 CONTRACT FUNDING AND BUDGET

3.08 CONTRACT PAYMENT

3.09 INFORMAL DEBRIEFING

3.10 CONTRACT PERSONNEL

3.11 INSPECTION & MODIFICATION – REIMBURSEMENT FOR UNACCEPTABLE DELIVERABLES

3.12 TERMINATION OF CONTRACT

3.13 BREACH OF CONTRACT

3.14 INDEMNIFICATION

3.15 CONTRACT AMENDMENTS

3.16 CONTRACT CHANGES – UNANTICIPATED AMENDMENTS

3.17 NONDISCLOSURE AND CONFIDENTIALITY

BACKGROUND INFORMATION

4.01 SELECT STATE IT SYSTEMS

SCOPE OF WORK

5.01 SCOPE OF WORK – OBJECTIVES

5.02 SCOPE OF WORK GENERAL REQUIREMENTS

5.03 SCOPE OF WORK – SPECIFIC REQUIREMENTS

5.04 ACTIVITIES EXCLUDED FROM SCOPE OF WORK

5.05 DELIVERABLES

5.06 CONTRACTOR TEAM QUALIFICATIONS

PROPOSAL FORMAT AND CONTENT

6.01 PROPOSAL FORMAT AND CONTENT

6.02 TECHNICAL PROPOSAL FORMAT

6.03 OFFEROR’S SCHEDULE OF PROFESSIONAL HOURS AND FEES

6.04 OFFEROR’S TOTAL COST STATEMENT

6.05 EVALUATION OF PROPOSALS

EVALUATION CRITERIA

7.01 UNDERSTANDING OF THE PROJECT AND METHODOLOGY (35 PERCENT)

7.02 MANAGEMENT PLAN FOR THE PROJECT (25 PERCENT)

7.03 FIRM EXPERIENCE AND STAFF EXPERIENCE AND QUALIFICATIONS (15 PERCENT)

7.04 CONTRACT COST (25 PERCENT)

RFP 26-33-03 Page 4 of 40 Issue Date: March 6, 2026

SECTION ONE

Introduction and Instructions

1.01 Purpose of the RFP

The Alaska Division of Legislative Audit (“DLA”) is seeking sealed proposals from information technology (IT) security/audit firms to perform cybersecurity reviews of select State of Alaska IT systems using the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and Center for Internet Security (CIS) controls.

1.02 Proposal Submission, Delivery, and Acceptance

An Offeror must submit and deliver its proposal in one sealed package to the issuing office identified on page 1 of this RFP, or may email its proposal to the Procurement Manager at the email address shown on page 1 of this RFP, no later than the date and time listed on page 1 of this RFP as the deadline for receipt of proposals. If mailed or hand delivered, the package must be marked on the outside to identify the RFP and the Offeror. If emailed, the email must contain the RFP number in the subject line of the email.

An Offeror must prepare and submit the Offeror’s COST PROPOSAL separately from the Offeror’s TECHNICAL PROPOSAL.

Only one (1) copy of the Offeror’s COST PROPOSAL should be submitted—in a separate sealed envelope or PDF document marked COST PROPOSAL—with the RFP number on the outside of the envelope or with the RFP number in the subject line of the email that the PDF Proposal is sent in.

Only one (1) copy of the TECHNICAL PROPOSAL with the remainder of the offer shall be submitted in a sealed envelope or container with the RFP number on the outside of the sealed envelope or container, or the TECHNICAL PROPOSAL with the remainder of the offer can be emailed in the form of a PDF document labeled TECHNICAL PROPOSAL with the RFP number in the subject line of the email that the PDF forms are sent in.

Emailed proposals must be submitted as an attachment in PDF format. The PDF document should be named in a format such as “Offeror A – Cost Proposal for RFP 26-33-03.pdf” ("Offeror A" is the name of the Offeror).

Please note that the maximum size of a single email (including all text and attachments) that can be received is 50 MB (megabytes). If the email containing the proposal exceeds this size, the proposal must be sent in multiple emails that are each less than 50 megabytes and each email must comply with the requirements described above. Please note that email transmission is not instantaneous; the Procurement Manager recommends sending proposals with enough time to ensure delivery by the deadline for receipt of proposals.

DLA is not responsible for unreadable, corrupt, or missing attachments. It is the Offeror’s responsibility to contact the issuing office at (907) 465-6705 – Voice, (907) 465-4980 – TDD to confirm that the emailed proposal has been received. Failure to follow the above instructions may result in the proposal being found non-responsive and rejected.

RFP 26-33-03 Page 5 of 40 Issue Date: March 6, 2026

Proposals must be received no later than the date and time listed on page 1 of this RFP as the deadline for receipt of proposals. Faxed or oral proposals will not be accepted.

It is the responsibility of the Offeror to ensure that its proposal and any issued RFP amendments (signed by the Offeror) are in the issuing office prior to the scheduled proposal closing time. A proposal will be rejected if the proposal or any signed amendments are not received prior to the closing date and time.

1.03 Photocopies

Photocopied proposals are allowed.

1.04 Contract Term and Work Schedule

The contract term and work schedule set out herein represents DLA’s best estimate of the schedule that will be followed. If a component of this schedule is delayed, the rest of the schedule may be shifted by the same number of days, at the discretion of DLA. The project schedule may be adjusted by the DLA Project Director with written notice to the Contractor.

The length of the contract will be from the date the contract is signed by the Legislative Auditor until project completion, approximately September 30, 2026.

The estimated RFP schedule is as follows:

March 6, 2026 Issue RFP March 13, 2026 Pre-Proposal Teleconference March 20, 2025 Deadline for Written Questions March 31, 2026 Deadline for Receipt of Proposals April 21, 2026 DLA issues Notice of Intent to Award a Contract May 4, 2026 Contract signed by DLA

After the contract has been awarded, the following key contract dates apply:

Item Anticipated Dates of Action

Project Starts June 1, 2026

Draft Copies of Reports Delivered to DLA September 14, 2026

Final Copies of Reports Delivered to DLA September 30, 2026

Note: All dates are approximate and subject to change.

RFP 26-33-03 Page 6 of 40 Issue Date: March 6, 2026

1.05 Location of Work

The work is to be performed at the Contractor’s location and in Juneau, Alaska, and Anchorage, Alaska. Work will be planned for hybrid execution—onsite sessions for collaborative activities such as stakeholder interviews, workshops and control validation, with other tasks performed remotely and —coordinated in advance with the stakeholders. Approximately 30% of the scope of work is expected to be performed onsite. “Onsite” means physically present at State-designated facilities to conduct interactive sessions, review systems, validate controls, and perform hands-on testing. The expectation is that the audit will be carried out through a combination of in-person and remote work. Approximately 15% of the Work is expected to be performed on-site at state agency offices in Juneau, Alaska, and approximately 15% of the Work on-site in Anchorage, Alaska.

DLA will not provide permanent workspace for the Contractor; however, it will provide office space in Juneau and Anchorage for field visits while performing audit work. DLA can accommodate up to four auditors at a time; however, office space will need to be coordinated with other audit projects. Additionally, workspace should be available at the auditee.

The percent of hours anticipated to be worked onsite in Alaska should be identified in an Offeror’s proposal. The Contractor must include in their lump sum price proposal: all incidentals and travel costs including transportation, lodging, and per diem costs sufficient to pay for travel to and within Alaska. Note: hotel space is limited during the summer tourist season and reservations should be made well in advance of travel.

1.06 Human Trafficking

By signature on the proposal, the Offeror certifies that the Offeror is not headquartered in a country recognized as Tier 3 in the most recent United States Department of State’s Trafficking in Persons Report.

In addition, if the Offeror conducts business in but is not headquartered in a country recognized as Tier 3 in the most recent United States Department of State’s Trafficking in Persons Report, a certified copy of the Offeror’s policy against human trafficking must be submitted to DLA prior to contract award.

The most recent United States Department of State’s Trafficking in Persons Report can be found at the following website: https://www.state.gov/reports-office-to-monitor-and-combat-trafficking-in-persons

If an Offeror fails to comply with this paragraph, DLA may reject, without liability, the Offeror’s proposal as non-responsive, cancel the intent to award to the Offeror, or cancel the resulting Contract to the Offeror.

1.07 Americans with Disabilities Act

The Alaska State Legislature complies with Title II of the Americans with Disabilities Act of 1990.

Individuals with disabilities who may need auxiliary aids, services, or special modifications to submit a proposal should contact the Procurement Manager no later than ten (10) days prior to the deadline for receipt of proposals to make any necessary arrangements. If a request for special

RFP 26-33-03 Page 7 of 40 Issue Date: March 6, 2026 arrangements is received less than ten (10) days prior to the deadline for receipt of proposals, DLA will attempt to accommodate the request.

1.08 Review of RFP

Offerors should carefully review this RFP, without delay, for defects and questionable or objectionable material. Comments concerning defects and objectionable material must be made in writing and received by the Procurement Manager at least ten (10) days prior to the deadline for receipt of proposals. This will help prevent opening a defective RFP and exposure of an Offeror’s proposal upon which award could not be made. Protests by an Offeror based on any omission or error, or on the content of the RFP, may be disallowed if the Offeror has not brought these faults to the attention of the Procurement Manager, in writing, ten (10) days prior to the deadline for receipt of proposals.

Offerors or their agents may not contact any member of the evaluation committee or their staff or any member of the Legislature or their staff regarding this RFP. All questions concerning this RFP must be directed to the Procurement Manager listed on the first page of this RFP.

1.09 Questions Received Prior to Deadline for Receipt of Proposals All questions must be directed to the Procurement Manager listed on the first page of this RFP.

Offerors or their agents may not contact any member of the Proposal Evaluation Committee (PEC) or their staff or any member of the Legislature or their staff regarding this RFP.

Two types of questions generally arise. One may be answered by directing the questioner to a specific section of the RFP. These questions may be answered over the telephone. The second type is a question requiring the Procurement Manager to clarify or interpret part of the RFP or its intent must be submitted in writing. Responses to this type of question will be given in writing via amendment to the RFP.

These questions should be received by the Procurement Manager at least ten (10) days prior to the deadline for receipt of proposals.

1.10 Amendments

If an amendment to this RFP is issued, it will be posted to the State of Alaska’s Online Public Notice (OPN) website and a courtesy notice may be provided to all who have registered with the Procurement Manager. However, it remains the Offeror’s responsibility to check the OPN for any updates or amendments.

1.11 Number of Proposals; Alternate Proposals

Only one (1) proposal per Offeror will be evaluated. If an Offeror submits more than one (1) proposal for evaluation, all prior proposals received by the Offeror will be rejected. See paragraph 2.04 (Amendments to Proposals) for instructions to amend a proposal submitted prior to the deadline for receipt of proposals.

Proposals that are not responsive to the type of work described in this RFP will be rejected.

RFP 26-33-03 Page 8 of 40 Issue Date: March 6, 2026

1.12 Right of Rejection

Offerors must comply with all of the terms of this RFP, Alaska Legislative Procurement Procedures, and all applicable local, state, and federal laws, codes, and regulations. The Procurement Manager may reject any proposal that does not comply with all of the material terms, conditions, or performance requirements of this RFP.

Offerors may not qualify or restrict the rights of DLA. If an Offeror does so, the Procurement Manager may declare the proposal to be non-responsive and the proposal may be rejected.

A proposal may be rejected if the proposal contains a material alteration or erasure that is not initialed by the signer of the proposal.

The Procurement Manager may waive minor informalities that:

a) do not affect responsiveness;

b) are merely a matter of form or format;

c) do not change the relative standing or otherwise prejudice other offers;

d) do not change the meaning or scope of the RFP;

e) are trivial, negligible, or immaterial in nature;

f) do not reflect a material change in the work, services, or products requested; or

g) do not constitute a substantial reservation against a requirement or provision.

Furthermore, a proposal may be rejected in whole or in part when rejection is in the best interest of DLA, as provided in sec. 130 of the Alaska Legislative Procurement Procedures.

1.13 Non-Award of Contract

This RFP does not obligate DLA to award a contract. The division is not liable for any costs incurred in the preparation of a proposal.

1.14 Disclosure of Proposal Contents

All proposals and other material submitted become the property of DLA and may be returned only at DLA’s option. All proposal information, including detailed price and cost information, will be confidential during the evaluation process and prior to the time a Notice of Intent to Award a Contract (NIA) is issued. Thereafter, proposals will become public information.

Trade secrets and other proprietary information contained in proposals may be held confidential if

(1) the Offeror requests, in writing, that the information be held confidential; and (2) the Procurement Manager agrees, in writing, to hold the information confidential. A request to hold information confidential under this paragraph must be included with the Offeror's proposal, must clearly identify the information the Offeror wishes to be held confidential, and must include a statement that sets out the reasons for confidentiality. Unless the Procurement Manager agrees in

RFP 26-33-03 Page 9 of 40 Issue Date: March 6, 2026 writing to hold the requested information confidential, that information will also become public after the NIA is issued.

1.15 Subcontractors

Subcontractors may be used to perform work under the contract. If an Offeror intends to use subcontractors, the Offeror must identify in the proposal the names of the subcontractors and the portions of the work the subcontractors will perform. Qualifications of subcontractor staff assigned to the engagement should be described in the same manner as Contractor staff.

If a proposal with subcontractors is selected, the Offeror must provide the following information concerning each prospective subcontractor within five working days from the date of DLA’s request:

a) complete name of the subcontractor;

b) complete address of the subcontractor;

c) type of work the subcontractor will be performing;

d) percentage of work the subcontractor will be providing;

e) evidence that the subcontractor holds a valid Alaska business license; and

f) a written statement, signed by each proposed subcontractor that clearly verifies that the subcontractor has agreed to render the services required by the contract and is free from conflicts of interest and is independent in fact and appearance.

An Offeror’s failure to provide this information, within the time set, may cause DLA to consider the Offeror’s proposal non-responsive and reject it. The substitution of one subcontractor for another may be made only at the discretion and with the prior written approval of the DLA Project Director.

All subcontractors that perform work under the contract resulting from this RFP are subject to the requirements of this RFP, including, but not limited to, the requirements of paragraphs 3.05 (Applicable Law) and 3.06 (Insurance Requirements) of this RFP.

1.16 Joint Ventures

Joint ventures are acceptable. If submitting a proposal as a joint venture, the Offeror must submit a copy of the joint venture agreement which identifies the principals involved and their rights and responsibilities regarding performance and payment.

1.17 Offeror’s Certification

By signature on the proposal, an Offeror certifies that:

a) the Offeror will comply with the laws of the State of Alaska;

b) the Offeror will comply with the applicable portion of the Federal Civil Rights Act of 1964;

RFP 26-33-03 Page 10 of 40 Issue Date: March 6, 2026

c) the Offeror will comply with the Equal Employment Opportunity Act and the regulations issued thereunder by the federal government;

d) the Offeror will comply with the Americans with Disabilities Act of 1990 and the regulations issued thereunder by the federal government;

e) the Offeror will comply with all terms and conditions set out in this RFP;

f) the proposal submitted was independently arrived at, without collusion;

g) the Offer shall be good and held firm for a period of at least 90 days from the date of deadline for receipt of proposals to the RFP; and

h) programs, services, and activities provided to the general public under the resulting Contract will conform to the Americans with Disabilities Act of 1990, and the regulations issued thereunder by the federal government.

If any Offeror fails to comply with a requirement of this paragraph, DLA reserves the right to disregard the proposal, terminate the Contract, or consider the Contractor in default under the Contract.

1.18 Conflict of Interest

Each proposal shall include a statement indicating whether or not the Offeror or any individuals working on the Contract has a possible conflict of interest, and if so, the nature of that conflict.

Examples of conflicts of interest include, but are not limited to, the Offeror currently being employed by the State of Alaska, formerly employed by the State of Alaska within the past five years, or currently providing services or proposing to provide services to the State, a political subdivision of the State, or a public corporation of the State.

Conflicts, or perceived or potential conflicts, will be evaluated by DLA for the degree of conflict.

The Offeror must provide information regarding its independence with respect to the reporting entity and its quality control procedures. Each of the following items must be disclosed or provided, as applicable:

1. A statement that the Offeror and any individuals working on the Contract do not have a conflict of interest with the State of Alaska;

2. All prior, current, or planned work, including non-audit services, with the State of Alaska.

In addition, the Offeror shall briefly describe all services the Offeror is planning to perform or has proposed to perform for the State of Alaska;

3. Any lawsuits against or involving the State of Alaska;

4. Any relationships with the State of Alaska that could impair independence.

The Contractor shall keep itself free from any potential conflict of interest and maintain its independence, both in fact and appearance. The Offeror must certify that it will not, at any time during the duration of the awarded contract, have an accounting, auditing, IT security, or any other relationship with any entity covered under the contract that may impair the independence of the

RFP 26-33-03 Page 11 of 40 Issue Date: March 6, 2026 contractor. Failure to disclose a conflict of interest during the period of performance will be treated as a breach of contract under sec 3.13 (Breach of Contract).

DLA reserves the right to consider a proposal non-responsive and reject it or cancel the award if any interest disclosed from any source could either give the appearance of a conflict or cause speculation as to the objectivity of the Offeror. DLA’s determination regarding any questions of conflict of interest is final.

1.19 Project Director

The administration of the Contract is the responsibility of the Project Director. The Project Director shall be named in the Contract but may be changed at any time at DLA’s discretion. DLA shall provide written notice to the Contractor of any change to the Project Director. References to the "Project Director" in this RFP refer to the individual named in the Contract, as described in this paragraph.

1.20 Assignment/Transfer

Assignment or transfer of the Contract is subject to sec. 160 of the Alaska Legislative Procurement Procedures.

1.21 Binding on Successors

Subject to paragraph 1.20 (Assignment/Transfer) and paragraph 1.24 (Severability) of this RFP, the Contract and all the covenants, provisions, and conditions contained in the Contract shall inure to the benefit of and be binding upon the successors and assignees of the Contractor and DLA.

1.22 Dispute

The Contract is governed by the laws of the State of Alaska and the Alaska Legislative Procurement Procedures. If the Contractor has a claim arising in connection with the Contract that cannot be resolved by mutual agreement, the claim will be resolved under sec. 350 of the Alaska Legislative Procurement Procedures.

1.23 Venue and Applicable Law

In the event that the parties to the Contract find it necessary to litigate the terms of the Contract, the venue shall be the State of Alaska, First Judicial District in Juneau, and the Contract shall be interpreted according to the laws of the State of Alaska.

1.24 Severability

If any provision of the Contract is declared by a court to be illegal or in conflict with any law, DLA and the Contractor shall be bound by the remainder of the Contract without the provision.

1.25 Procurement Procedures

This RFP is subject to the Alaska Legislative Procurement Procedures. A copy of the Alaska Legislative Procurement Procedures can be obtained from the website link located on page one (1) of this RFP or a copy may be requested by emailing the Procurement Manager listed on page one

(1) of this RFP.

RFP 26-33-03 Page 12 of 40 Issue Date: March 6, 2026

1.26 Records; Audit

The requirements in this paragraph are in addition to any other records required by this RFP. The Contractor shall accurately maintain detailed time records that state the date and detail of the work done and identify the individual(s) that did the work for any labor hours invoiced under the Contract. The Contractor shall also keep any other records that are required by the Contract or the Project Director. The records required by this paragraph are subject to inspection by DLA at all reasonable times.

1.27 Materials and Processes Covered by Patents, Trademarks, or Copyrights If the Offeror employs any design, device, material, or process covered by a patent, trademark, or copyright not held by the Offeror, it is the Offeror’s responsibility to obtain permission to use the design, device, material, or process from its owner. The Offeror shall indemnify, hold harmless, and defend the Legislature, the State of Alaska, DLA, the officers, agents, and employees of the Legislature and DLA, and any affected third party from any and all claims for infringement by reason of the use of patented design, device, material or process, or any trademark or copyright, and for any costs, expenses, and damages due to infringement at any time during the work or after the completion of the work.

1.28 Ownership and Reuse of Documents

All data, documents, reports, material, and other items generated as a consequence of work done under the Contract are the property of DLA. To the extent the Offeror has any interest in the copyright for these items under the copyright laws of the United States, the Offeror transfers any and all interest the Offeror has in the copyright for these items to DLA, and DLA will be the owner of the copyright for these items. Upon completion of the work or termination of the Contract, all items shall be delivered to the Project Director. Offeror acknowledges that all the items are the property of DLA.

1.29 Coverage Under the Ethics Law

Certain provisions of AS 24.60 (the Legislative Ethics Act) apply to legislative contractors. It is the responsibility of the Contractor to review AS 24.60 and remain compliant with all applicable provisions of AS 24.60 throughout the term of the Contract.

1.30 Cancellation of Solicitation

This RFP may be canceled as provided in sec. 120 of the Alaska Legislative Procurement Procedures.

RFP 26-33-03 Page 13 of 40 Issue Date: March 6, 2026

SECTION TWO

Standard Proposal Information

2.01 Authorized Signature

All proposals must be signed by an individual authorized to bind the Offeror to the provisions of the RFP. Proposals made in accordance with the RFP shall constitute a continuing offer that will remain open for ninety (90) days after the deadline for receipt of proposals in response to this RFP even if, during the ninety (90) days, the NIA to another Offeror is issued or a Contract is entered into with another Offeror.

2.02 U.S. Funds

Prices quoted shall be in U.S. funds.

2.03 Taxes

The Contractor is responsible for all local, state, or federal taxes. All proposals shall be submitted exclusive of federal, state, and local taxes.

2.04 Amendments to Proposals

Except as specifically allowed in this paragraph, amendments to or withdrawals of proposals will only be allowed if requests are received before the deadline for receipt of proposals. Amendment or withdrawal will not be accepted after the deadline unless the amendment or withdrawal is in response to a request made by DLA.

2.05 Supplemental Terms and Conditions

Proposals must comply with paragraph 1.12 (Right of Rejection) of this RFP. If DLA fails to identify or detect a term or condition in a proposal that conflicts with this RFP or that diminishes DLA’s rights under the Contract resulting from the RFP, the conflicting term or condition will be severed from the contract and unenforceable.

After award of Contract, unless otherwise specified in the Contract:

a) if there is a conflict between a term or condition included in the proposal and a term or condition of the RFP, the term or condition of the RFP will prevail;

b) if there is a conflict between (1) the RFP or the proposal, and (2) the Contract, the Contract will govern; and

c) if DLA’s rights would be diminished as a result of a term or condition included in the proposal, the term or condition will be considered unenforceable.

2.06 Clarification of Offers

In order to determine if a proposal is susceptible for award, communications by the Procurement Manager on behalf of the Proposal Evaluation Committee (PEC) are permitted with an Offeror to clarify uncertainties or eliminate confusion concerning the contents of a proposal. Clarifications may not result in a material or substantive change to the RFP or the proposal. The evaluation by the PEC may be adjusted as a result of clarification under this paragraph 2.06.

RFP 26-33-03 Page 14 of 40 Issue Date: March 6, 2026

2.07 Prior Experience

In order for offers to be considered responsive, Offerors must meet these minimum prior experience requirements.

1. Supervisory personnel and technical leads that are proposed to be assigned to the Scope of Work must hold advanced IT security certifications that demonstrate qualifications and competence to perform the Scope of Work. Supervisory personnel and technical leads must have at least seven years of experience performing cybersecurity assessments of governmental organizations similar to the Scope of Work described in this RFP. Minimum qualifications of the project team are described in sec 5.07 (Contractor Team Qualifications).

2. The Offeror must not have been suspended or debarred by the federal government, and shall affirm that they are not on the federal excluded parties list; and

3. The Offeror shall comply with the obligations under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended, and its accompanying requirements.

An Offeror's failure to meet these minimum prior experience requirements will cause its proposal to be considered non-responsive and their proposal will be rejected.

2.08 Evaluation of Proposals

An evaluation committee made up of at least three state employees or public officials will evaluate proposals. The evaluation will be based solely on the evaluation factors set out in section Seven (Evaluation Criteria) of this RFP.

After receipt of proposals, if there is a need for any substantial clarification or material change in the RFP, an amendment will be issued. The amendment will incorporate the clarification or change and establish a new date and time for new or amended proposals. Evaluations may be adjusted as a result of receiving new or amended proposals.

2.09 Federal Tax ID

An Offeror must submit a valid Federal Tax ID to DLA within five (5) working days after the date of DLA’s request.

2.10 Alaska Business License, Legal Entity and Other Required Licenses Prior to the award of a contract, an Offeror must hold a valid Alaska business license. However, in order to receive the Alaska Bidder Preference and other related preferences, an Offeror must hold a valid Alaska business license prior to the deadline for receipt of proposals. If claiming the Alaska Bidder Preference, a copy of the business license must be included with the proposal.

Offerors should contact the Department of Commerce, Community and Economic Development, Division of Corporations, Business, and Professional Licensing or visit their website:

https://www.commerce.alaska.gov/web/; phone: (907) 465-2550; email:

businesslicense@alaska.gov; mailing: P.O. Box 110806, Juneau, Alaska 99811-0806 for information on the license. Acceptable evidence that the Offeror possesses a valid Alaska business license may consist of any one of the following:

https://www.commerce.alaska.gov/web/ mailto:businesslicense@alaska.gov

RFP 26-33-03 Page 15 of 40 Issue Date: March 6, 2026

a) copy of an Alaska business license;

b) certification on the proposal that the Offeror has a valid Alaska business license, and inclusion of the license number in the proposal;

c) a canceled check or other proof of payment of the Alaska business license fee;

d) a copy of the Alaska business license application with a receipt stamp from the state’s occupational licensing office; or

e) a sworn and notarized affidavit that the Offeror has applied and paid for the Alaska business license.

Prior to the deadline for receipt of proposals, all Offerors must hold any other necessary applicable professional licenses required by Alaska statutes or regulations.

2.11 Alaska Bidder Preference

If an Offeror qualifies for the Alaska Bidder Preference, the Offeror will receive a preference of five percent (5%) applied to the Offeror’s total cost proposal before points are calculated in accordance with paragraph 2.12 (Formula Used to Convert Cost to Points) of this RFP. The Alaska Bidder Preference will be given to an Offeror who:

1) holds a current Alaska business license prior to the deadline for receipt of proposals;

2) submits a proposal for the Contract under the name appearing on the Offeror’s current Alaska business license;

3) has maintained a place of business within the state staffed by the Offeror, or an employee of the Offeror, for a period of six months immediately preceding the date of the proposal;

4) is incorporated or qualified to do business under the laws of the state, is a sole proprietorship and the proprietor is a resident of the state, is a limited liability company (LLC) organized under AS 10.50 and all members are residents of the state, or is a partnership under AS 32.06 or AS 32.11 and all partners are residents of the state; and

5) if a joint venture, is composed entirely of ventures that qualify under (1) – (4) of this paragraph.

In order to receive the Alaska Bidder Preference, the proposal must include a statement that the Offeror is eligible to receive the Alaska Bidder Preference.

If the Offeror is an LLC or partnership as identified in (4) of this paragraph, the statement must also identify each member or partner and include a statement certifying that all members or partners are residents of the State.

If the Offeror is a joint venture that includes an LLC or partnership as identified in (4) of this paragraph, the statement must also identify each member or partner of each LLC or partnership

RFP 26-33-03 Page 16 of 40 Issue Date: March 6, 2026 that is included in the joint venture and include a statement certifying that all of those members or partners are residents of the state.

2.12 Formula Used to Convert Cost to Points

The distribution of points based on cost will be determined by the Procurement Manager. Cost Proposals will have the Alaska Bidder’s Preference applied to the proposed total cost prior to converting cost to points. The lowest cost proposal will receive the maximum number of points allocated to cost. The points allocated to cost on the other proposals will be determined through the method set out below. In the generic example below, cost is weighted as 25 percent (25%) of the overall total score. See Section Seven (Evaluation Criteria) to determine the value, or weight of cost for this RFP.

EXAMPLE

Formula Used to Convert Cost to Points

[STEP 1]

List all proposal prices, adjusted where appropriate by the application of all applicable preferences.

Offeror #1 - Non-Alaskan Offeror $40,000 Offeror #2 - Alaskan Offeror $42,750 – ($45,000 proposal with 5% AK Bidder Preference applied) Offeror #3 - Alaskan Offeror $47,500 – ($50,000 proposal with 5% AK Bidder Preference applied)

[STEP 2]

Convert cost to points using this formula.

[(Price of Lowest Cost Proposal) x (Maximum Points for Cost)] (Cost of Each Higher Priced Proposal) = POINTS

The RFP allotted 25 percent (25%) or 25 points of the total of 100 points for cost.

Offeror #1 receives 25 points.

Offeror #1 received 25 points because the lowest cost proposal, in this case $40,000, receives the maximum number of points allocated to cost, 25 points.

Offeror #2 receives 23.4 points.

$40,000 x 25 = 1,000,000 ÷ $42,750 = 23.4 Lowest Max Offeror #2 Points Cost Points Adjusted By The Application Of All Applicable Preferences

Offeror #3 receives 21.1 points.

$40,000 x 25 = 1,000,000 ÷ $47,500 = 21.1 Lowest Max Offeror #3 Points

RFP 26-33-03 Page 17 of 40 Issue Date: March 6, 2026

Cost Points Adjusted By The Application Of All Applicable Preferences

2.13 Contract Negotiation

After issuing the Notice of Intent to Award, the Legislative Auditor may elect to initiate contract negotiations with the Offeror selected for the award. The option of whether or not to initiate contract negotiations rests solely with the Legislative Auditor.

The Legislative Auditor may terminate negotiations with a successful Offeror who has been selected for award on the Notice of Intent to Award, and may commence negotiations with another Offeror, if the successful Offeror:

a) fails to provide the information required to begin negotiations in a timely manner;

b) fails to negotiate in good faith;

c) indicates they cannot perform a contract within the budgeted funds available for the project; or

d) cannot come to terms after a good faith effort to negotiate with DLA.

2.14 Notice of Intent to Award – Offeror Notification of Selection

Upon selection of an apparent successful Offeror, the Procurement Manager will issue a written Notice of Intent to Award (NIA) and send copies to all Offerors. The NIA will set out the names of all Offerors and identify the proposal selected for award.

2.15 Protest

If an Offeror wishes to protest a solicitation, the award of a contract, or the proposed award of a contract, the protest must be filed as required by sec. 230 and sec. 240 of the Alaska Legislative Procurement Procedures.

2.16 Pre-Proposal Teleconference

All prospective Offerors are encouraged to call in to the pre-proposal teleconference. This pre-proposal teleconference will be held on Friday, March 13, 2026 at 1:00 pm, Alaska Time. To attend, Offerors must call one of the following teleconference lines: 907-586-9085 (Juneau), 907- 563-9085 (Anchorage), or 1-844-586-9085 (toll free outside of Juneau and Anchorage).

The purpose of the teleconference is to discuss details of the RFP with prospective Offerors and allow them to ask questions concerning the RFP. Call-in attendance at the pre-proposal teleconference is not mandatory. The Procurement Manager will not provide any detail on information given during the teleconference to potential Offerors who do not attend the teleconference. Prior to the meeting participants should read the RFP and come prepared to discuss any concerns and ask questions.

RFP 26-33-03 Page 18 of 40 Issue Date: March 6, 2026

Questions asked during the teleconference will be answered in accordance with paragraph 1.09 (Questions Received Prior to Deadline for Receipt of Proposals). The Procurement Manager may request potential Offerors to submit questions in writing for further clarification.

Offerors with a disability needing accommodation should contact the Procurement Manager prior to the date set for the pre-proposal teleconference so that reasonable accommodation can be made.

RFP 26-33-03 Page 19 of 40 Issue Date: March 6, 2026

SECTION THREE

Standard Contract Information

3.01 Format of Contract

The Contract will be in the format desired by DLA.

3.02 Contract Approval

The Contract to be entered into as a result of this RFP and any amendments entered into after the signing of the Contract will be subject to approval by Legislative Budget and Audit Committee (LBAC). DLA will not be responsible for any work done by the Contractor, even work done in good faith, if it occurs prior to the signing of the Contract.

3.03 Proposal as a Part of the Contract

Part or all of this RFP and the successful proposal will be incorporated into the Contract.

3.04 Additional Terms and Conditions

DLA reserves the right to include additional terms and conditions in the Contract.

3.05 Applicable Law

The Contractor must comply with all applicable federal and state labor, wage, hour, safety, and any other laws which have a bearing on the Contract and must have all licenses and permits required by applicable federal, state, or municipal law for performance of the Contract.

3.06 Insurance Requirements

Without limiting indemnification responsibilities under paragraph 3.14 (Indemnification) and paragraph 1.27 (Materials and Processes Covered by Patents, Trademarks, or Copyrights), the Contractor shall purchase at its own expense and maintain in force at all times during the performance of services under this agreement, the policies of insurance listed below. Where specific limits are shown, it is understood that they shall be the minimum acceptable limits. If the Contractor’s policy contains higher limits, DLA is entitled to coverage to the extent of such higher limits. Certificates of insurance must be furnished to the Project Director prior to beginning work and must provide for notice of cancellation, nonrenewal, or material change of conditions. Failure of the Contractor to furnish DLA with satisfactory evidence of insurance, or to notify DLA of the lapse of, or material change in, the policy, is a material breach of the Contract and shall be grounds for termination of the Contractor’s services. All insurance policies shall comply with and be issued by insurers authorized in Alaska or another state to transact the business of insurance.

Workers Compensation Insurance: The Contractor shall provide and maintain, for all employees engaged in work under this Contract, coverage as required by AS 23.30.045, and as required by any other applicable statute. The policy must waive subrogation against the state.

A Successful Offeror who is an entity without employees may satisfy the workers’ compensation requirements of this paragraph by submitting a signed letter stating that the Successful Offeror is an entity without employees and that if at any time during the term of the Contract, one or more employees are hired, the Successful Offeror will purchase, at its own

RFP 26-33-03 Page 20 of 40 Issue Date: March 6, 2026 expense, and maintain in force at all times workers’ compensation insurance for the employee or employees and submit proof of the workers’ compensation insurance to the Project Director.

Commercial General Liability Insurance: Covering all business premises of, and operations by or on behalf of, the Contractor in the performance of the Contract, including, but not limited to, blanket contractual coverage, products coverage, premises and operations coverage, independent Contractor's coverage, broad form property damage endorsement, and personal injury endorsement; the policy must have minimum coverage limits of $1,000,000 combined single limit per occurrence and annual aggregates where generally applicable. Unless waived by DLA, the insurance policy shall name DLA as an additional insured.

Commercial Automobile Liability Insurance: Covering all vehicles used by the Contractor in the performance of work under this Contract with minimum coverage limits of $500,000 combined single limit per occurrence.

All insurance shall be considered to be primary and non-contributory to any other insurance carried by DLA through self-insurance or otherwise.

The Contractor shall provide evidence of continuous coverage by submitting, without reminder, annual renewal certificates for the required insurance to the Project Director for the life of the Contract.

3.07 Contract Funding and Budget

Funds are contingent upon the approval of LBAC to award a Contract. Upon LBAC approval, funds will be available in an appropriation to pay for DLA’s monetary obligations under the Contract through June 30, 2026. The availability of funds to pay for DLA’s monetary obligations under the Contract after June 30, 2026, is contingent upon appropriation by the Legislature of funds to pay for work conducted from July 1, 2026, through the end of the Contract. In addition to any other right of DLA under the Contract to terminate the Contract, if, in the judgment of DLA, sufficient funds are not appropriated, the Contract will be terminated by DLA, or amended, without liability of DLA for the termination or amendment. To terminate under this paragraph 3.07, the Project Director shall provide written notice of the termination to the Contractor and the Contract will be terminated under paragraph 3.12 (Termination of Contract) of this RFP.

3.08 Contract Payment

No payment will be made until the billing is approved by the Project Director. If a payment is not made within 90 days after DLA has received properly approved billing, DLA shall pay interest on the unpaid balance of the billing at the rate of 1.5 percent (1.5%) per month from, and including, the 91st day through the date payment is made. A payment is considered made on the date it is mailed or personally delivered to the Contractor.

DLA is not responsible for and will not pay local, state, or federal taxes. All costs associated with the Contract must be stated in U.S. currency.

RFP 26-33-03 Page 21 of 40 Issue Date: March 6, 2026

3.09 Informal Debriefing

When the contract is completed, an informal debriefing may be performed at the discretion of the DLA Project Director. If performed, the scope of the debriefing will be limited to the work performed by the Contractor.

3.10 Contract Personnel

During the Contract, any work performed and billed by the Contractor must be performed by the Contractor personnel named in the proposal. Any changes to the Contractor personnel named in the proposal must be approved, in advance and in writing, by the Project Director prior to the commencement of work. Personnel changes that are not approved by the Project Director may be grounds for DLA to terminate the Contract or reject invoices based on work by non-approved personnel.

3.11 Inspection & Modification – Reimbursement for Unacceptable Deliverables The Contractor is responsible for the completion of all work set out in the Contract. All work is subject to inspection, evaluation, and approval by the Project Director. DLA may employ all reasonable means to ensure that the work is progressing and being performed in compliance with the Contract. The Project Director may instruct the Contractor to make corrections or modifications, if needed, in order to accomplish the Contract’s intent. The Contractor will not unreasonably withhold such changes.

In addition to any other right of DLA under the Contract to terminate the Contract, DLA may terminate the Contract for substantial failure of the Contractor to perform the Contract. In this event, DLA may require the Contractor to reimburse monies paid (based on the identified portion of unacceptable work received) and may seek damages.

3.12 Termination of Contract

Upon delivery of written notice to the Contractor, the Contract may be terminated by the Legislative Auditor with or without cause. To terminate, the Project Director shall provide notice by email or delivery of a hard copy to the Contractor; the method selected for notice is at the sole discretion of the Legislative Auditor. If the Contract is terminated and the termination is not based on a breach by the Contractor, DLA shall compensate the Contractor for services provided under the terms of the Contract up to the date the termination notice is delivered, provided the Contractor provides DLA with a written statement containing a description, including, but not limited to, the detailed records required by paragraph 1.26 (Records; Audit) of the services provided prior to contract termination and any other records requested by the Project Director.

3.13 Breach of Contract

In case of a breach of the Contract by the Contractor, for whatever reason, DLA may procure the services from other sources and hold the Contractor responsible for damages resulting from the breach.

3.14 Indemnification

The Contractor shall indemnify, hold harmless, and defend DLA, the Alaska State Legislature, officers, agents, and employees of DLA and the Alaska State Legislature from liability of any nature or kind, including, but not limited to, costs, attorney fees, and expenses, for or on account

RFP 26-33-03 Page 22 of 40 Issue Date: March 6, 2026 of any and all legal actions or claims of any character whatsoever resulting from injuries or damages sustained by any person or persons or property as a result of any error, omission, or negligence of the Contractor that occurs on or about DLA’s or State of Alaska premises or that relates to the Contractor's performance of its contractual obligations.

3.15 Contract Amendments

In addition to any other amendments…