RFP 32_Cybersecurity Audit Services.pdf

THIS PROPOSAL MUST BE RETURNED ELECTRONICALLY THROUGH THE ROCKY MOUNTAIN E-

CONTRACTS SYSTEM (BIDNET®).

Department of General Services

ADMINISTRATION DIVISION

Phone: (720) 865-7515

City and County of Denver

Administration Division 201 W. Colfax Ave.

Department 1110, 6th Floor Denver, CO 80202

Procurement Analyst: Matt Monaghan Procurement Analyst Email: matt.monaghan@denvergov.org

REQUEST FOR PROPOSAL

Request for Proposal No. 32 For City Executed Contract

Cybersecurity Audit Services

SCHEDULE OF EVENTS

• RFP Issued April 22, 2025

• Deadline to Submit Additional Questions May 1, 2025 11:00 A.M. Local Time

• Response to Written Questions May 7, 2025

• Proposal Due Date May 22, 2025 2:00 P.M. Local Time

Contractor offers to furnish to the City and County of Denver the materials, supplies, products or services requested in accordance with the specifications and subject to the Terms and Conditions described herein.

CONTRACTOR SIGN HERE

Company: ______________________________________________________________________________ -Note: Contractor company name to be the legal entity that will enter into a contract with the City if awarded pursuant to this solicitation-

Address: ______________________________________________________________________________

Contact: ______________________________________ │ ______________________________________ (Authorized Signature) (Print Name)

Signature constitutes acceptance of all Terms and Conditions listed on this form and all documents attached.

Email: ______________________________________________________________________________

Phone: _____________________________________________________________________________

The City contracts with Rocky Mountain E-Contracts System (BidNet®) in the advertisement and facilitation of solicitations administered by the City's General Services Contracts Division; therefore, respondents must ONLY rely on documents provided on the Rocky Mountain E-Contracts System (BidNet®) website or as communicated directly from the analyst. Only rely on this web address:

https://www.bidnetdirect.com/colorado https://www.bidnetdirect.com/colorado

GSPD TEMPLATE 3.5.2025 SD04

Table of Contents

SECTION A: GENERAL INFORMATION & PROPOSAL INSTRUCTIONS

A.1 PURPOSE:

A.2 ROCKY MOUNTAIN E-PURCHASING (BidNet®):

A.3 ELECTRONIC SUBMISSION OF PROPOSALS:

A.4 RFP QUESTIONS:

A.5 ADDENDA:

A.6 PROPOSAL AND PERFORMANCE BONDS AND SURETIES:

A.7 ACCEPTANCE PERIOD:

A.8 TECHNICAL REQUIREMENTS/STATEMENT OF WORK:

A.9 RFP CONDITIONS AND PROVISIONS:

A.10 GRATUITIES AND KICKBACKS:

A.11 NON-COLLUSIVE CONTRACTOR CERTIFICATION:

A.12 EVALUATION AND AWARDS:

A.13 PROOF OF REGISTRATION WITH THE COLORADO SECRETARY OF STATE:

A.14 DIVERSITY AND INCLUSIVENESS – EXECUTIVE ORDER #101:

SECTION B: SCOPE OF WORK AND TECHNICAL REQUIREMENTS

B.1 SCOPE OF WORK/REQUIREMENTS:

B.1.a Project Background B.1.b Project Objective B.1.c Project Deliverables B.1.d Project Timeline B.1.e Project Administration

B.2 CONTRACTOR QUESTIONS AND REQUIREMENTS:

B.3 PAYMENT TERMS:

B.4 TERM:

B.5 BACKGROUND CHECKS AND DISQUALIFICATION:

B.6 EMERGENCY PURCHASES:

B.7 CONTRACTOR PERFORMANCE MANAGEMENT:

B.8 ENVIRONMENTAL MANAGEMENT SYSTEM, ENVIRONMENTAL POLICY, AWARENESS,

AND COMPLIANCE:

B.8.a Environmentally Preferable Contracts (EPP) Guidance

SECTION C: PRICING

C.1 PRICING INFORMATION:

C.2 PRICING INSTRUCTIONS:

C.3 PRICING:

C.4 PROPOSAL ITEMS:

SECTION D: SAMPLE EXECUTED CONTRACT TERMS AND CONDITIONS

SECTION E: ADDITIONAL REQUIRED INFORMATION

E.1 CONTRACT CERTIFICATION FORM:

E.2 DISCLOSURE OF CONTENTS OF BIDS CERTIFICATION FORM (REDACTED COPY)

E.3 DENVER CONTRACTOR SUSTAINABILITY:

E.4 SMALL BUSINESS INFORMATION REQUEST (OPTIONAL):

E.5 CONTRACTOR'S CHECK LIST:

E.6 CONTRACTOR INFORMATION:

Attachment A – Sample Agreement

SECTION A: GENERAL INFORMATION & PROPOSAL INSTRUCTIONS

A.1 PURPOSE:

The City and County of Denver, hereinafter referred to as the City, desires to solicit proposals relating to the contracting of Cybersecurity Audit Services.

Click HERE to go directly to the City’s detailed Scope of Work/ Requirements

A.2 ROCKY MOUNTAIN E-PURCHASING (BidNet®):

The City is collaborating with Rocky Mountain E-Purchasing System (BidNet®) in the advertisement and facilitation of Invitation for Bid (IFB)s and Requests for Proposals (RFP) administered by the City’s General Services Contracts Division.

It is a requirement of this RFP that interested parties familiarize themselves and register with BidNet®;

Contractors who do not register may be considered non-responsive.

Registration with BidNet® is available at NO CHARGE and allows Contractors access to view governmental bids posted on BidNet®; they offer an additional notification service option with an associated fee. It is the responsibility of the Contractor to evaluate and select the service option of their choice.

The City is not responsible for the actions or lack thereof on the part of the Contractor in regards to their interaction with BidNet®, or any other third-party bid notification service in relation to this RFP.

More information is available at: www.rockymountainbidsystem.com or by calling 1-800-835-4603.

A.3 ELECTRONIC SUBMISSION OF PROPOSALS:

Submission of proposals for this solicitation may only be done electronically through BidNet®. Proposals must be submitted at www.rockymountainbidsystem.com, no later than the date and time indicated in the proposal.

Contractors who feel they are unable to prepare and submit an electronic submittal should submit a request in writing to the Analyst, no later than the Question due date, for permission and instructions for submitting a hardcopy proposal.

Your proposal shall consist of the following separate sections:

i) Signed Coversheet

ii) Response to ‘CONTRACTOR QUESTIONS AND REQUIREMENTS’: Section B.2

iii) Pricing – Section C.4

iv) Section E. Forms

v) Additional Required Information/ Forms/ Documentation http://www.rockymountainbidsystem.com/ http://www.rockymountainbidsystem.com/

A.4 RFP QUESTIONS:

The City shall not be bound by and the Contractor shall not request or rely on any oral interpretation or clarification of this RFP. Therefore, any questions regarding this RFP are encouraged and should be submitted in writing by email to:

City Procurement Analyst: Matt Monaghan E-Mail: matt.monaghan@denvergov.org

Questions received up to deadline to submit question in the Schedule of Events will be answered in writing per the Schedule of Events. Answers to questions from any Contractor will be provided to all Contractors.

All communications regarding this proposal shall only be through the City’s Analyst listed above. No communication is to be directed to any other City personnel.

A.5 ADDENDA:

In the event it becomes necessary to revise, change, modify or cancel this Proposal or to provide additional information, addenda will be issued and made available on BidNet® at www.rockymountainbidsystem.com. It is the responsibility of the Contractor to confirm that they have acquired all addenda related to this solicitation and they have reviewed/ complied with the requirements therein.

A.6 PROPOSAL AND PERFORMANCE BONDS AND SURETIES:

Proposal and performance sureties are not required in this procurement.

A.7 ACCEPTANCE PERIOD:

Proposals in response to this RFP shall indicate that they are valid for a period no less than 120 days from the closing date, and if awarded, through the initial contract period.

A.8 TECHNICAL REQUIREMENTS/STATEMENT OF WORK:

Section B of this RFP contains our proposed Statement of Work and/or Technical Requirements. This document shall form the basis of a Contract covering the subject matter of this RFP. Exceptions or deviations to this proposal must not be added to the proposal pages and instead must be written on Contractor’s letterhead and accompany proposal. Any exceptions to this documentation will be taken into consideration when evaluating proposals submitted. The City reserves the right to reject any or all of your proposed modifications. The City welcomes cost saving proposals which still satisfy all technical and business objectives.

A.9 RFP CONDITIONS AND PROVISIONS:

This proposal must be signed by a duly authorized official of the proposing company. The completed and signed proposal (together with all required attachments) must be returned to the Department of General Services on or before the time and date of the deadline shown on page one. This proposal MUST be submitted electronically through the Rocky Mountain E-Contracts System (BidNet® at www.rockymountainbid system.com).

All participating Contractors, by their signature hereunder, shall agree to comply with all of the conditions, requirements and instructions of this RFP as stated or implied herein. Any alteration, erasure or interlineation by mailto:matt.monaghan@denvergov.org http://www.rockymountainbid/ the Contractor in this proposal shall constitute cause for rejection by the Manager of General Services. Should the City omit anything from this RFP which is necessary to a clear understanding of the work, or should it appear that various instructions are in conflict, then the Contractor shall secure written instructions from the Manager of General Services at least forty-eight (48) hours prior to the time and date shown in page one.

Typographical errors in entering quotations on your proposal may result in loss of award of this proposal.

All Contractors are required to complete all information requested in this proposal. Failure to do so may result in the disqualification of proposal.

The City reserves the right to postpone or cancel this RFP, or reject all proposals, if determined to be in the best interest of the City.

Unit pricing for each item shall be shown and shall be for the unit of measurement indicated. In case of error in extension of prices, the unit price will govern.

The Manager of General Services reserves the right to waive any technical or formal errors or omissions and to reject any and all proposal(s), or to award a contract for the items hereon, either in part or whole, if deemed to be in the best interests of the City.

The successful Contractor shall be in complete compliance with all of the specifications, terms and conditions of this proposal as outlined above.

No submittal shall be accepted from, and no contract will be awarded to, any person, firm or corporation that is in arrears to the City and County of Denver, upon debt or contract, or that is a defaulter, as surety or otherwise, upon any obligation to the City, or that has failed to attain or demonstrate compliance with any law, ordinance, City regulation, or contract term or condition as may be provided for or required in any City contract, or that may be deemed irresponsible or unreliable by the Manager of General Services. Contractors may be required to submit satisfactory evidence that they have a practical knowledge of the particular work bid upon and that they have the necessary financial resources to perform and complete the work outlined in this solicitation.

The Contractor agrees to abide by all the laws, regulations and administrative rulings of the United States, the State of Colorado and the City and County of Denver, securing all necessary licenses and permits in connection with the bids.

All services performed under the terms of a resulting contractual agreement shall comply with the requirements and standards specified in the Williams-Steiger Occupational Safety and Health Act of l970 (Public Law 9l-596) as well as with other applicable federal, state and local codes.

All services performed must comply with City and State Codes.

In the event that this solicitation requires a formal contract to be prepared by the City and County of Denver, the successful Contractor will properly sign and furnish necessary performance bonds, insurances, Workers’ Compensation, etc., as required by the respective bid within ten (l0) days (unless a longer period is allowed) from the date of receipt of the formal contract forms.

All Contractors must take into consideration that only the City’s contract documents will be used in the finalization of this agreement. This will include the total bid and the City Attorney’s general form.

The City shall not be liable for any costs incurred by Contractor in the preparation of proposals or for any work performed in connection therewith or any work subsequent to the submission and prior to the execution of any contract.

A.10 GRATUITIES AND KICKBACKS:

It shall be a breach of ethical standards for any person to offer, give, or agree to give any employee or former employee (within six months of termination from City employment), or for any employee or former employee (within six months of termination from City employment) to solicit, demand, accept, or agree to accept from another person, a gratuity or an offer of employment in connection with any decision, approval, disapproval, recommendation, preparation of any part of a program requirement or a purchase request, influencing the content of any specification or procurement standard, rendering of advice, investigation, auditing, or in any other advisory capacity in any proceeding of application, request for ruling, determination, claim or controversy, or other particular matter, pertaining to any program requirement or a contract or subcontract, or to any solicitation or proposal therefore.

It shall be a breach of ethical standards for any payment, gratuity, or offer of employment to be made by or on behalf of a subcontractor under a contract to the prime Contractor or higher tier subcontractor or any person associated therewith, as an inducement for the award of a subcontract or order.

In the event that any gratuities or kickbacks are offered or tendered to any City, the proposal shall be disqualified and shall not be reinstated.

A.11 NON-COLLUSIVE CONTRACTOR CERTIFICATION:

By the submission of this proposal, the Contractor certifies that:

A. The proposal has been arrived at by the Contractor independently and has been submitted without collusion with any other Contractor.

B. The contents of the proposal have not been communicated by the Contractor, nor, to its best knowledge and belief, by any of its employees or agents, to any person not an employee or agent of the Contractor or its surety on any bond furnished herewith and will not be communicated to any such person prior to the official opening of the proposal.

C. No Contractor shall submit more than one proposal for this purchase. It shall be the responsibility of each Contractor to obtain the prior written permission of the Director of Contracts before proposal opening in every situation in which the Contractor, due to corporate association or other affiliation, may be found to be impermissibly associated with another Contractor. Failure to observe this requirement could result in all such affiliated proposals being rejected.

A.12 EVALUATION AND AWARDS:

One award will be made on an “all or none” basis.

The criteria to be used for the proposal evaluation include but are not limited to:

(a) Pricing – Section C.4

(b) Response to ‘CONTRACTOR QUESTIONS AND REQUIREMENTS:’ posed in Section B.2

(c) Other Required Submittals (as applicable)

(d) Qualified, Responsible, Responsive_ {D.R.MC. Sec. 20-61-(d), (f), (g)}

(e) Response to the City’s proposed Sample Agreement provisions – Section D

No weighting or relative importance of criteria is intended or implied by this list.

The City may request oral presentations as part of the evaluation process. Additionally, the City reserves the right to conduct negotiations with one or more Contractors. While numerical scoring may be used as an aid in the evaluation, the selection ultimately is a business decision that will reflect an integrated assessment of the relative merits of proposals using the factors identified in this RFP.

Any award as a result of this proposal shall be contingent upon the execution of an appropriate contract. Section D of this proposal contains the City’s terms and conditions. These terms and conditions shall form the basis of a Contract covering the subject matter of this proposal. If there is contention(s) with the Terms and Conditions, a brief explanation and alternative language, if any, should be included in your response in the provided Section E.

CONTRACT CERTIFICATION FORM. Any exceptions to the Terms and Conditions will be taken into consideration when evaluating proposals submitted. The City reserves the right to reject any or all of your proposed modifications.

A.13 PROOF OF REGISTRATION WITH THE COLORADO SECRETARY OF STATE:

Successful Contractors are required to furnish a Certificate of Good Standing from the Colorado Secretary of State’s Office, as proof that they are properly registered to do business in the State of Colorado, prior to finalization of award and contracting.

A.14 DIVERSITY AND INCLUSIVENESS – EXECUTIVE ORDER #101:

Definitions

Diversity: Diversity refers to the extent to which a Contractor has people from diverse background or communities working in its organization at all levels, is committed to providing equal access to business opportunities and achieving diversity in procurement decisions for supplies, equipment, and services, or promotes training and technical assistance to diverse businesses and communities such as mentoring and outreach programs and business engagement opportunities.

Inclusiveness: Inclusiveness, for purposes of Executive Order No. 101, includes the extent to which a contractor/consultant invites values, perspectives and contributions of people from diverse backgrounds and integrates diversity into its hiring and retention policies, training opportunities, and business development methods to provide an equal opportunity for each person to participate, contribute and succeed within the organization’s workplace. Inclusiveness also includes the extent to which businesses have an equal opportunity to compete for new business opportunities and establish new business relationships in the private and public sector.

Requirements

Using the attached form, entitled “Diversity and Inclusiveness in City Solicitations Information Request Form”, please state whether you have a diversity and inclusiveness program for employment and retention, procurement and supply chain activities, or customer service, and provide the additional information requested on the form.

The information provided on the Diversity and Inclusiveness in City Solicitations Request Form will provide an opportunity for City contractors/consultants to describe their own diversity and inclusiveness practices.

Contractors/Consultants are not expected to conduct intrusive examinations of their employees, managers, or business partners in order to describe diversity and inclusiveness measures. Rather, the City simply seeks a description of the contractor/consultant’s current practices, if any.

Diversity and Inclusiveness information provided by City contractors/consultants in response to City solicitations for services or goods will be collated, analyzed, and made available in reports consistent with City Executive Order No. 101. However, no personally identifiable information provided by or obtained from contractors/consultants will be in such reports.

Please link to the form here: https://us.openforms.com/Form/57f3a8ea-39b7-4115-be17-1770f38d3cf6

NOTE: A DIVERSITY & INCLUSIVENESS FORM MUST BE RETURNED WITH YOUR

PROPOSAL; OTHERWISE, YOUR PROPOSAL MAY BE REJECTED WITHOUT

CONSIDERATION.

https://us.openforms.com/Form/57f3a8ea-39b7-4115-be17-1770f38d3cf6

SECTION B: SCOPE OF WORK AND TECHNICAL REQUIREMENTS

B.1 SCOPE OF WORK/REQUIREMENTS:

B.1.a Project Background The City and County of Denver Auditor’s Office (“Auditor’s Office”) has identified two cybersecurity risks for which it may not have sufficient expertise or experience to perform the work to resolve.

B.1.a.1 Risk #1 – City Clerk and Recorder Systems The existing systems configurations and network used by the City Clerk and Recorder’s office to support the office’s systems may not be properly configured.

B.1.a.2 Risk #2 – Active Directory The configurations of the City’s instance of Active Directory may not be properly configured. This risk affects multiple City agencies.

B.1.b Project Objective

B.1.b.1 City Clerk and Recorder Cybersecurity – Conduct an assessment of the City’s current processes and procedures to ensure the City’s Clerk and Recorder System is secure by performing penetration testing of the systems associated with operational systems. In addition, review the appropriate policies and procedures are in place to guide employees in their security duties.

B.1.b.2 Active Directory – Conduct an assessment of the City’s Active Directory strategy, processes, and procedures. The audit will seek to discover all instances of Active Directory across the City (multiple agencies) and examine the controls associated with those instances on a sample basis. The review will need to examine the Global Policy Objectives and trust relationships and other configurations to ensure they are properly established based on best practices and other guidance which the City may need to follow.

B.1.c Project Deliverables

B.1.c.1 Design and perform audit testing procedures to ensure the safety of the network and applications used in the instances described above. A unique scope for each affected agency will be agreed upon after rules of engagement are confirmed with the agency under review. The testing will include but will not be limited to penetration testing, configuration analysis, log examination.

B.1.c.2 Produce a Confidential Workpaper which the City defines as a document that is not subject to

Freedom of Information Act requests, delivered to each affected agency, the Audit Committee, and Auditor’s Office with detailed findings and corresponding recommendations per assessment. The contractor is responsible for composing this report and will need to be approved by the Auditor’s Office representatives.

B.1.c.3 Produce a public facing informational report per the assessments prepared by the contractor and approved by the Auditor’s Office representatives.

B.1.c.4 Give a presentation to the City’s Audit Committee per assessment with a PowerPoint using the Auditor’s Office template.

The following two deliverables for each assessment are due after the completion of the presentations (B.1.c.4):

B.1.c.5 Follow-up Confidential Workpaper which the City defines as a document that is not subject to

Freedom of Information Act requests, delivered after the last due date of the recommendation in the original assessment.

B.1.c.6 Presentation to the City’s Audit Committee per the follow-up workpaper with a PowerPoint using the Auditor’s Office template.

B.1.d Project Timeline B.1.d.1 Both assessments will be performed at the same time and should take appropriately nine (9) months to complete.

B.1.d.2 The follow-up assessments will occur approximately one (1) year after the initial testing is performed but is dependent on the timeline of the recommendations in the report developed by the contractor. The follow-up assessments should take approximately six (6) months.

B.1.e Project Administration

B.1.e.1 The contractor will be expected to have weekly meetings with representatives from the Auditor’s Office. This will be a status meeting to coordinate and communicate next steps and project progress.

B.1.e.2 The contractor will likely have weekly meetings with the City agency under review. This will be both a status and information gathering meetings with the client.

B.1.e.3 During fieldwork, the contractor may be expected to meet with the City agency under review multiple times.

B.1.e.4 The contractor will respond to feedback from the Auditor’s Office and City agency subject to assessment on all deliverables.

B.2 CONTRACTOR QUESTIONS AND REQUIREMENTS:

Your proposal must specifically address each of the questions or issues that are listed below. The quality and detail of your responses will figure significantly in the overall evaluation of your proposal. Contractors are encouraged to give examples and provide additional information to support your compliance on each point. To standardize the format of all proposals, Contractors are required to respond to all questions in the order given and to list the item number and restate the question prior to giving their answer. Failure to comply with this requirement may result in your proposal being declared non-responsive.

B.2.a.1 Describe your firm’s professional expertise in IT and Cybersecurity auditing.

B.2.a.2 Describe your firm’s experience auditing applications.

B.2.a.3 Describe your firm’s experience auditing Active Directory with multiple domains.

B.2.a.4 Describe your firm’s experience with auditing 3rd party systems based on contractual requirements.

B.2.a.5 Describe the audit tools your firm would employ to achieve the City’s project deliverables.

B.2.a.6 Submit individual resumes for members of your firm that would work on this project. Staff and leadership must have a minimum of five (5) years of cybersecurity auditing experience and hold relevant certifications.

B.2.a.7 Describe your firm’s strategy for communicating and collaborating with clients. This may include attending meetings as needed, providing weekly status updates, and responding to feedback from City representatives.

B.2.a.8 Provide a minimum of three (3) firms or government organizations for which your firm has provided similar work. Include the name of the firm, contact information, and a brief description of the work.

B.3 PAYMENT TERMS:

The City shall make payments upon the completion of the milestones listed below. Percentages represent the amount of the total firm and fixed proposal price (Section C.4).

• 1st payment: 30% after project kickoff

• 2nd payment: 40% after first presentation to Audit Committee (B.1.c.4)

• 3rd payment: 20% after follow-up kickoff

• Final payment: 10% after second presentation to Audit Committee (B.1.c.6)

The City’s Prompt Payment Ordinance, §§ 20-107 to 20-118, D.R.M.C., applies to invoicing and payment under this Agreement. Contractor and the Auditor’s Office shall establish an invoicing procedure upon execution of the contract.

B.4 TERM:

The effective period of the contract resulting from this proposal shall be three (3) years from date of City signature. Subject to the City’s prior written authorization, the Contractor shall complete any work in progress as of the expiration date and the Term will extend until the work is completed or earlier terminated by the City.

B.5 BACKGROUND CHECKS AND DISQUALIFICATION:

Because of the nature of the scope and requirements herein for the City, Contractor, at its expense, must conduct, or have previously conducted a background check for each of its employees, as well as for the employees of its subcontractors, who will provide services to the City. Background checks are to be conducted through an independent background check third-party and must include the following:

• Social Security Number Trace;

• Federal Criminal Records (includes wants, warrants, arrests, convictions, and incarcerations);

• Colorado Criminal Records (includes wants, warrants, arrests, convictions, and incarcerations);

• Criminal Records from other States if the employee disclosed, or the background check identifies, that the employee lived in another state in the last seven years (includes wants, warrants, arrests, convictions, and incarcerations); and

• National Sexual Offender Registry Search.

The background check shall include all convictions for the last seven years and may include additional convictions beyond seven years when permitted and/or required by law.

Because of the sensitive nature of the work proposed within this solicitation, the City shall automatically disqualify from employment under this contract persons with felony convictions. Alternatively, the City may require that a fidelity bond, or such other assurance in such amount as deemed appropriate, be provided to the City as a condition precedent to grant permission where an employee’s prior conviction would otherwise preclude their participation under the contract.

All Contractor employees are required to self-disclose to the Contractor any criminal charges and convictions and nolo contendere pleas (not contest pleas) that occur while providing services to the City within three business days of the conviction, charge, or plea. Contractor is required to inform the City of any criminal charges or convictions or nolo contendere pleas (no contest pleas) that arise while an employee is on assignment with the City. Contractor must inform the City within one business day of the Contractor having knowledge of the charge, conviction, or plea. The City will determine, in its sole discretion, whether the employee will remain on a City assignment.

Contracts for work at the following locations require NCIC background checks:

• Police Academy

• Denver Animal Shelter

• Traffic Operations

• DPD Police Precincts

• DPD Crime Lab

• Medical Examiner

Other City locations may also require a NCIC background check. These background checks will be administered by the City and will be at no cost to the Contractor. Contractor employees will be required to provide their social security numbers to the City. Contractors will be provided entrance cards for each facility. Contractors are not allowed to share cards to provide services. The background check(s) must be conducted successfully prior to initial access and/or involvement by employees. Employees who separate from the Contractor’s employment must undergo another background check prior to renewed access and/or involvement in providing services to the City.

The City also has the ability to audit the Contractor’s background check process, to ensure compliance with City standards, at any time. Failure by the Contractor to comply with the terms of this Section may result in the termination of its contract with the City.

B.6 EMERGENCY PURCHASES:

The City and County of Denver reserves the right to purchase from other sources those items which are required on an emergency basis and cannot be supplied immediately by the Contractor.

B.7 CONTRACTOR PERFORMANCE MANAGEMENT:

The Auditor’s Office has identified key performance indicators for monitoring the Contractor’s performance.

The Auditor’s Office will evaluate the Contractor’s performance and provide feedback throughout the contract term.

• Meeting mutually agreed upon deadlines for deliverables (assessments, confidential and public workpapers, presentations).

• Facilitating the project by organizing regular meetings with City personnel to report progress.

• Achieving the overall project completion timeline.

B.8 ENVIRONMENTAL MANAGEMENT SYSTEM, ENVIRONMENTAL POLICY, AWARENESS, AND

COMPLIANCE:

Some City operations can pose risks to human health and the environment. Proactive environmental management can reduce risk and prevent harm. The Denver Environmental Performance Program (DEPP) is the City’s ISO 14001 Environmental Management System (EMS). The DEPP ensures all aspects of City operations with the potential to cause environmental impacts are proactively managed. The DEPP reinforces the City’s position that the City’s business partners are aware of the City’s Environmental Policy, and are responsible for supplying goods and services in a manner consistent with this policy. The DEPP also requires business partners ensure the competency of their staff with respect to the environmental impacts of their duties.

The Environmental Policy of the City & County of Denver, may be found at:

https://denvergov.org/files/assets/public/v/2/public-health-and-environment/documents/eq/2024-denver-environmental-policy.pdf

All City business partners are required to comply with federal, state, and local environmental regulations. The DEPP requires all City business partners to be aware of the impacts their products and services have on the environment and implement practices to minimize impacts, prevent pollution, and align outcomes with the City’s environmental performance goals.

The Contractor shall provide products and services under this agreement consistent with the City’s Environmental Policy and any environmental performance goals identified by the agency for whom the contractor is performing work.

B.8.a Environmentally Preferable Contracts (EPP) Guidance

The City defines Environmentally Preferable products and services as those having a lesser or reduced effect on human health and the environment when compared with competing products and services serving the same purpose. The City’s EPP evaluation may extend to materials of manufacture, packaging, transport, recycled content, energy consumption, local recyclability, waste disposal, and other factors.

Contractors are encouraged to describe any EPP attributes of the goods or services they offer to the City.

Applicable EPP considerations may factor in product and service evaluations.

https://denvergov.org/files/assets/public/v/2/public-health-and-environment/documents/eq/2024-denver-environmental-policy.pdf https://denvergov.org/files/assets/public/v/2/public-health-and-environment/documents/eq/2024-denver-environmental-policy.pdf

SECTION C: PRICING

C.1 PRICING INFORMATION:

This section shall include a description of the proposed costs and prices. All pricing information shall be limited solely to this section of your proposal. This section should address all requirements set forth in Section B as well as any other items pertinent to your proposal pricing. The requirements have been developed to allow the City to uniformly evaluate prices submitted for the work. Accordingly, you should follow these instructions carefully and provide all data requested in the formats specified herein and in any referenced attachments.

Any omissions in this proposal shall be identified by each Contractor and incorporated into their proposal. The City will not increase the contract or any purchase order (either dollar amount or time) for items not included in the submitted proposal documents. The City reserves the right to purchase part or the entire proposal.

C.2 PRICING INSTRUCTIONS:

Pricing shall be in the format contained in the RFP. Do not include cost or price figures anywhere except in the cost and pricing section.

C.3 PRICING:

All prices quoted shall be firm and fixed for the specified contract period. No updates to pricing shall be permitted.

C.4 PROPOSAL ITEMS:

Bid Item Description

Firm & Fixed Price

1 All Services per Scope of Work (Section B.1)

Total $

SECTION D: SAMPLE EXECUTED CONTRACT TERMS AND CONDITIONS

This section shall include your response to our proposed terms and conditions included in this Section D and shall form the basis for the preparation of a Contractual Agreement covering the subject matter of this RFP.

You shall respond in your proposal either that all terms and conditions contained in Attachment A – Sample Agreement are acceptable or that some are acceptable, and some are not. Underline or highlight those words, phrases, sentences, paragraphs, etc. that are not satisfactory and note any exceptions by referencing the appropriate article number, a brief explanation and alternative language, if any, and submit same on a separate typewritten sheet. Any exceptions will be taken into consideration when evaluating your proposal.

SECTION E: ADDITIONAL REQUIRED INFORMATION

E.1 CONTRACT CERTIFICATION FORM:

CITY AND COUNTY OF DENVER

DEPARTMENT OF GENERAL SERVICES

Proposal #32 Cybersecurity Audit Services_________________________________________

NOTICE: ANY PROPOSED MODIFICATIONS TO THE LANGUAGE OF THE CITY’S SAMPLE

AGREEMENT MUST BE CONTAINED IN THE PARAGRAPHS BELOW OR ON A REDLINED VERSION

OF THE SAMPLE AGREEMENT. ANY CONTRACTOR MODIFICATION THAT DOES NOT INCLUDE

SPECIFIC LANGUAGE CHANGES MAY BE CONSIDERED NON-RESPONSIVE BY THE CITY AND

CONTRACTOR WAIVES ANY RIGHTS TO NEGOTIATE THE SAMPLE AGREEMENT LANGUAGE AT

A LATER TIME. THE FOLLOWING TERMS OF THE AGREEMENT ARE NON-NEGOTIABLE:

• Governing Law and Venue

• Discrimination in Employment

• Examination of Records

• Defense and Indemnification

THE FOLLOWING TERMS OF THE AGREEMENT ARE ONLY NEGOTIATED IN EXCEPTIONAL

CIRCUMSTANCES:

• Payment

• Termination for Convenience

I, on behalf of the Contractor identified below, hereby certify that I have read a copy of the sample contract attached to the Proposal. I further hereby certify that it is the Contractor’s intent to agree to, and comply with each and every term and provision contained in the sample contract and propose no modifications to the sample contract except as follows:

1) 2) 3)

☐ Put checkmark in box if no proposed modifications.

I understand that the language modification(s) stated above, if any, are offered for discussion purposes only and that the City and County of Denver reserves the right to accept, reject or further negotiate any and all proposed modification to the sample contract. Contractor expressly agrees to all sample contract language where no modifications are proposed.

Company Name:

Authorized Signature (Required):

Name (please print):

Title: ____________________________________________________________________ Date:____________________________________________________________________

E.2 DISCLOSURE OF CONTENTS OF BIDS CERTIFICATION FORM (REDACTED COPY)

CITY AND COUNTY OF DENVER

DEPARTMENT OF GENERAL SERVICES

All materials provided in response to this RFP are subject to the Colorado Open Records Act, § 24-72-201, et seq., C.R.S.

(“CORA”). In the event of a CORA request to the City for disclosure of such materials, information that a Proposer has clearly and in good faith marked as “confidential” or “trade secrets” (collectively, “Protected Items”) will not be disclosed by the City, unless otherwise provided by law. If necessary, a Proposer shall seek a court order to protect their Protected Items, and will defend, indemnify, and hold harmless the City from any claim or action related to the City’s withholding of Protected Items.

THE FOLLOWING ARE NOT PROTECTED BY CORA:

1. Proposed pricing information

2. Public Company Information

3. Marketing literature readily viewable to the public on the respondent’s website or otherwise publicly available.

4. Training materials, manuals, procedures, protocols, or other publicly available information.

5. Any proposed content that would be assumed to be included in the awarded agreement (if the proposer was awarded) with the City (City agreements are public documents).

I, on behalf of the proposer identified below, hereby certify that I have read this form and affirm that proposer has NO redactions, and all proposed content is open to the public upon completion of the RFP selection process and award. Proposer will clearly and in good faith mark as “confidential” or “trade secrets” any additional information provided during this RFP process that proposer believes are Protected Items.

Proposer Name: ____________________________________________________________ Authorized Signature (Required):

Name (please print):

Date: ____________________________________________________________________

OR

I, on behalf of the proposer identified below, hereby certify that I have read this form and affirm that proposer has clearly and in good faith marked as “confidential” or “trade secrets” (collectively, “Protected Items”) any information proposer wishes to be withheld in the event of a CORA Request (unless otherwise provided by law) and has provided separate copies/files of any such proposed documents (e.g., Acme Technical Response {Redacted Copy}) with the requested redactions (via red font strike through). Proposer will also clearly and in good faith mark as “confidential” or “trade secrets” any additional information provided during this RFP process that proposer believes are Protected Items.

Proposer Name: ____________________________________________________________ Authorized Signature (Required):

Name (please print):

Date: ____________________________________________________________________

E.3 DENVER CONTRACTOR SUSTAINABILITY:

The City encourages Contractors to demonstrate a commitment to and experience in environmental sustainability and public health protection practices applicable to its line of products and/or services being procured in this proposal. See Section A of this proposal for the Sustainable Denver Policy and Guidance. The following are areas that may be addressed.

Explain how your products and/or service supports the City’s goal of environmentally preferable Contracts.

• Manufacturing Process

• Product Content

• Transportation

• Packaging

• Performance

• End of Life

• Third Party Certification (Green Seal, Eco Logo, Design for the Environment, etc.)

• Other

To aid the City in future proposals for this good/service, the City is seeking information from the Contractor community on what changes may affect this request in the area of environmentally preferable specifications. The City reserves the right to review and incorporate the information provided in future specifications/scopes of work.

E.4 SMALL BUSINESS INFORMATION REQUEST (OPTIONAL):

In an effort to engage with underutilized businesses or communities, the City is requesting voluntary disclosure of any certification(s) held by your company, whether it is SBE, MBE, VBE, WBE, DBE or a combination of these categories. If the certifying entity is the City, documentation does not need to accompany your proposal.

Such certification is to be current and the certifying entity documentation should reflect the following information:

• The name of the Certifying body

• Name of the Supplier/Contractor certified

• Contact information of the certifying body

• Start date/End date of the certification

• If applicable, commodities and services supplier/Contractor is certified to perform

• Additional information as identified by the Certifying entity

The City would also like to know if your company is considered a small business but is not certified by any certifying body. In addition, if your company’s supply chain contains products from an underutilized entity/ small business that go into the creation of the products that you offer, please provide their information as well.

This information is for statistical purposes only and will not have any affect when evaluating the bid proposals.

Supplier Name:

Type of Certification (s):

Certifying entity(ies):

Please submit copies of the appropriate certification(s) with your Proposal.

For more information on the SBA small business determination, the link to the process is https://www.sba.gov/size-standards/ https://www.sba.gov/size-standards/

E.5 CONTRACTOR'S CHECK LIST:

The following check list should be used to ensure required documentation is attached to the proposal. If a document is not required for your proposal, write n/a in the blank.

1.

Have you signed the front page of the proposal?

2.

Have you reviewed all proposal prices, checked unit costs, extensions and totals?

3.

Have you supplied any alternatives or additional information on separate headed note paper?

4.

Have you responded to or completed and included in your response all of the City’s requirements, questions, forms, including the Contractor sustainability form and other city requests (where applicable)?

5.

Have you assured that there is sufficient time to transmit this proposal?

6.

Have you enclosed relevant technical literature or samples (where applicable)?

7.

Have you completed and included the XO-101 Diversity and Inclusivity Information Request Form (Section A.14)?

E.6 CONTRACTOR INFORMATION:

In fo rm at io n

Contractor

Business Name Tax ID # (TIN or SSN)

Business Address Telephone Number

City, State Zip Fax Number

Order Address (If different from above) Email

City, State, Zip Ordering Email (If different from above) Contractor Entity Type (check one) Remittance Name Individual LLP/LLC Remittance Address Partnership Sole Proprietor Corporation Government City, State, Zip Exempt/Non-Profit Employee

Dun & Bradstreet Number

SIC Code and/or NAICS Code

Disadvantaged Business Enterprise (DBE) Yes No

Certification Source

Type (check all that apply) DBE Disadvantage Business Enterprise

Certification Number MBE Minority Business Enterprise

WBE Women Business Enterprise SBE Small Business Enterprise Certification

Beginning Date SBEC Small Business Enterprise Concessions ACDBE Airport Concession Disadvantage Business Enterprise

Certification Expiration Date

Other:

Awardee(s) will be required to provide copies of organizational documents.

(e.g., articles of organization/incorporation)