RFP 26-33-03 NIA.pdf

This is a Notice of Intent to Award for RFP 26-33-03 issued by the Alaska Division of Legislative Audit under the direction of Contracting Officer JC Kestel. The procurement seeks cybersecurity assessment services for three select State of Alaska IT systems: MyAlaska, MyRnB/Employer Services/eReporting, and the New DAIS Permanent Fund Dividend system. The assessments will utilize the National Institute of Standards and Technology Cybersecurity Framework version 2.0 and Center for Internet Security Critical Security Controls version 8.1 to deliver comprehensive reviews including asset identification, risk and threat assessments, vulnerability assessments, network architecture evaluation, application security testing, database security review, identity and access management assessment, data protection verification, cloud security evaluation, policy review, physical security assessment, security awareness training evaluation, monitoring and logging analysis, third-party risk management review, and business continuity/disaster recovery planning assessment. Work will be performed on a hybrid basis with approximately 30 percent onsite in Juneau and Anchorage and 70 percent remote. The pre-proposal teleconference was held on March 13, 2026, with the proposal deadline extended to April 3, 2026, at 2:00 p.m. Alaska Time. Draft reports were due September 14, 2026, with final reports due September 30, 2026. Contract initiation was scheduled for June 1, 2026, with contract execution anticipated by May 4, 2026.

The Notice of Intent to Award, dated April 24, 2026, identifies System Soft Technologies Inc. of Tampa, Florida as the proposed awardee with a total score of 68.94 points. Evaluation criteria weighted understanding of project and methodology at 35 percent, project management plan at 25 percent, firm and staff experience and qualifications at 15 percent, and contract cost at 25 percent. Qualifying proposals included scores from PwC US Consulting LLP (67.33 points) and Securance LLC (65.64 points), while thirteen other firms were deemed non-responsive. Minimum qualification requirements mandate that supervisory personnel and technical leads hold advanced IT security certifications with at least seven years of experience performing cybersecurity assessments of governmental organizations. Offerors meeting Alaska residency and business criteria were eligible for an Alaska Bidder Preference of five percent. Cost proposals required lump-sum, all-inclusive hourly rates broken down by system and inclusive of all direct and indirect costs, travel, lodging, and per diem. Contractors must maintain Workers' Compensation Insurance, Commercial General Liability Insurance with a minimum $1,000,000 combined single limit, and Commercial Automobile Liability Insurance with a minimum $500,000 combined single limit. Funding was contingent on approval by the Legislative Budget and Audit Committee, with funds available through June 30, 2026. Protestors had ten calendar days from the Notice of Intent issuance to file protests.