RFP Document 22RFP0929B-EC

REQUEST FOR PROPOSAL 22RFP0929B-EC

Vulnerability Scanning and Assessment Tool For

Fulton County Government

RFP ISSUANCE DATE: THRUSDAY, SEPTEMBER 15, 2022

RFP DUE DATE AND TIME: THURSDAY, OCTOBER 20, 2022 at 11:00 AM PRE-PROPOSAL CONFERENCE DATE: THURSDAY, SEPTEMBER 29, 2022 at 10:00 AM PURCHASING CONTACT: ELSA D. CASTRO at 404-612-4216 E-MAIL: Elsa.Castro@FultonCountyGa.gov

LOCATION: FULTON COUNTY GOVERNMENT

DEPARTMENT OF PURCHASING & CONTRACT COMPLIANCE

130 PEACHTREE STREET, S.W., SUITE 1168

ATLANTA, GA 30303

mailto:Elsa.Castro@FultonCountyGa.gov

Table of Contents

SECTION 1 – INTRODUCTION 3

1.1 PROJECT DESCRIPTION

1.2 METHOD OF SOURCE SELECTION

1.3 BACKGROUND [Optional

1.4 COUNTY OBJECTIVES

1.5 OBTAINING THE RFP

1.6 PRE-PROPOSAL CONFERENCE ….…………………………………………………………………………. 3

1.7 PROPOSAL DUE DATE

1.8 CONTACT PERSON AND INQUIRIES

1.9 PROCUREMENT SCHEDULE

SECTION 2 – INSTRUCTIONS TO PROPOSERS

2.1 PROCUREMENT PROCESS

2.2 CONTRACT DEFINITIONS

2.3 NO CONTACT DURING PROCUREMENT PROCESS

2.4 CLARIFICATION & ADDENDA

2.5 TERM OF CONTRACT

2.5 MULTI-YEAR CONTRACT TERM ............................................................. Error! Bookmark not defined.

2.6 PROPOSAL EVALUATION

2.7 DISQUALIFICATION OF PROPOSERS

2.8 RESERVED RIGHTS

2.9 APPLICABLE LAWS

2.10 INSURANCE AND RISK MANAGEMENT PROVISIONS

2.11 ACCURACY OF RFP AND RELATED DOCUMENTS

2.12 RESPONSIBILITY OF PROPOSER

2.13 CONFIDENTIAL INFORMATION

2.14 COUNTY RIGHTS AND OPTIONS

2.15 COST OF PROPOSAL PREPARATION AND SELECTION PROCESS

2.16 TERMINATION OF NEGOTIATIONS

2.17 WAGE CLAUSE

2.18 ADDITIONAL OR SUPPLEMENTAL INFORMATION

2.19 REPORTING RESPONSIBILITIES

2.20 GEORGIA SECURITY AND IMMIGRATION COMPLIANCE ACT

2.21 AUTHORIZATION TO TRANSACT BUSINESS

2.22 RIGHT TO PROTEST

2.23 NON-COLLUSION

2.24 CERTIFICATE OF ACCEPTANCE

2.25 EXCEPTIONS TO THE COUNTY’S CONTRACT

2.26 CERTIFICATION REGARDING DEBARMENT

2.27 INTERGORVERNMENTAL COOPERATIVE PROCUREMENT STATEMENT

2.28 GENERAL REQUIREMENTS

SECTION 3 – PROPOSAL REQUIREMENTS

3.1 OVERVIEW OF PROPOSAL REQUIREMENTS

3.2 FORMAT & PROPOSAL SUBMISSION INSTRUCTIONS

3.3 SCOPE OF WORK

3.4 INFORMATION TECHNOLOGY SOLUTION

3.5 PRODUCT SUPPORT AND CUSTOMER SERVICE REQUIREMENTS

3.6 TECHNICAL PROPOSAL FORMAT AND CONTENT

SECTION 4 – EVALUATION PROCESS

4.1 EVALUATION COMMITTEE

4.2 EVALUATION AND SELECTION PROCESS

4.3 RESPONSIVENESS REVIEW

4.4 EVALUATION SELECTION CRITERIA

4.5 NOTIFICATION OF SELECTION

22RFP0929B-EC

SECTION 1 – INTRODUCTION

1.1 PROJECT DESCRIPTION

Fulton County, Georgia (“County”) is Fulton County Government (“County”) is seeking proposals for Vulnerability Scanning and Assessment Tool Solutions.

Through the issuance of this Request for Proposal (“RFP” and/or “Proposals”), the County is soliciting Proposals for vulnerability scanning and assessment tools that will integrate into the current infrastructure as a part of the vulnerability management program.

Proposals provided in response to this RFP that comply with the submittal requirements set forth in Section 4.0, including all forms and certifications, will be evaluated in accordance with the criteria and procedures described in Section 5.0. Based on the results of the evaluation, the County will award the Vulnerability Scanning and Assessment Tool Solutions to the most advantageous Proposer based on the cost and the evaluation factors set forth in the RFP.

1.2 METHOD OF SOURCE SELECTION

This procurement is being conducted in accordance with all applicable provisions of the Fulton County Code of Ordinances and the specific method of source selection for the services required in this Proposal is Code Section 102-374, Competitive Sealed Proposals.

This procurement is being conducted in accordance with all applicable provisions of the Fulton County Code of Ordinances and the specific method of source selection for the services required in this Proposal is Code Section 102-375, Competitive Selection Procedures for Professional and Consultant Services.

1.3 BACKGROUND

Fulton County is the state’s most populous county with approximately 1.01 million residents representing 10% of the state of Georgia’s population. It is located in the center of the Atlanta Metropolitan area. The County is geographically diverse and dynamic, encompassing 528.7 square miles and stretching more than 70 miles from one end to the other.

The County is governed by a seven-member Board of Commissioners which operates under the Commissioner-County Manager form of government. This system combines the policy leadership of elected officials with the administrative abilities of a County Manager. The County Manager implements Board policy, administers the County government, and is responsible for the overall administration of all County departments.

Currently, the County employs approximately 5,000 full time employees.

1.4 COUNTY OBJECTIVES

The vulnerability scanning and assessment tool will play a key role the vulnerability management program. The primary objectives of the vulnerability scanning and assessment tool are as follows:

A – Complete visibility of all assets.

B – Scanning for and classification of Vulnerabilities C – Identify and rank risk associated with vulnerabilities found D – Integrate with current and future systems to provide a holistic approach to vulnerability management E – Remediate vulnerabilities found within designated SLAs assigned by severity/risk level

F – Automate the process of vulnerability scanning, risk prioritizing, and remediation

G – Provide reporting capabilities that range from high level review to investigative analysis. As well as provide compliance reporting

1.5 OBTAINING THE RFP

In order to obtain complete information about this solicitation, please click the link below where this document and supporting documents can be downloaded, https://www.bidnetdirect.com/georgia/fultoncounty.

1.6 PRE-PROPOSAL CONFERENCE

A Pre-Proposal Conference will be held via web-conference.

Date: Thursday, September 29, 2022 Time: 10:00 am Web Conference Link: https://zoom.us/j/96383123957

Meeting ID: 963 8312 3957

One tap mobile

+14703812552,,96383123957# US (Atlanta)

+14702509358,,96383123957# US (Atlanta)

Dial by your location

+1 470 381 2552 US (Atlanta)

+1 470 250 9358 US (Atlanta)

+1 786 635 1003 US (Miami)

+1 267 831 0333 US (Philadelphia)

+1 301 715 8592 US (Washington DC)

+1 312 626 6799 US (Chicago)

+1 646 518 9805 US (New York)

+1 646 558 8656 US (New York)

+1 651 372 8299 US (Minnesota)

+1 720 928 9299 US (Denver)

+1 971 247 1195 US (Portland)

+1 206 337 9723 US (Seattle)

+1 213 338 8477 US (Los Angeles)

+1 253 215 8782 US (Tacoma)

+1 346 248 7799 US (Houston)

+1 602 753 0140 US (Phoenix)

+1 669 219 2599 US (San Jose)

+1 669 900 9128 US (San Jose) https://www.bidnetdirect.com/georgia/fultoncounty https://zoom.us/j/96383123957

Meeting ID: 963 8312 3957

Find your local number: https://zoom.us/u/ajpXpw6w1

Join by SIP

96383123957@zoomcrc.com

Join by H.323

162.255.37.11 (US West)

162.255.36.11 (US East)

115.114.131.7 (India Mumbai)

115.114.115.7 (India Hyderabad)

213.19.144.110 (Amsterdam Netherlands)

213.244.140.110 (Germany)

103.122.166.55 (Australia Sydney)

103.122.167.55 (Australia Melbourne)

149.137.40.110 (Singapore)

64.211.144.160 (Brazil)

149.137.68.253 (Mexico)

69.174.57.160 (Canada Toronto)

65.39.152.160 (Canada Vancouver)

207.226.132.110 (Japan Tokyo)

149.137.24.110 (Japan Osaka)

The purpose of the Pre-Proposal Conference is to provide information regarding the project and to address any questions and concerns regarding the services sought by the County through this RFP.

However, no verbal response provided at the Pre-Proposal Conference binds the County. Only those responses to questions submitted through BidNet Direct and responded to by the County will be official.

Inquiries regarding the solicitation either technical or otherwise may be submitted prior to the Pre- Proposal Conference and will be addressed during the Pre-Proposal Conference.

Any additional questions asked at the Pre-Proposal Conference will be responded to in the form of an addendum with the County’s official responses.

Fulton County does not discriminate on the basis of disability in the admission or access to its programs or activities. Any requests for reasonable accommodations required by individuals to fully participate in any open meeting, program or activity of Fulton County Government should be directed to Mario Avery, Contract Compliance Administrator at (404) 612-6307 or email: mario.avery@fultoncountyga.gov.

1.7 PROPOSAL DUE DATE

All proposals will be received by the Department of Purchasing & Contract Compliance electronically through BidNet Direct at https://www.bidnetdirect.com/georgia/fultoncounty on or before Thursday, October 20, 2022 at 11:00 A.M., legal prevailing time. All submitted responses will be electronically time and date stamped at the time all documents are uploaded and received.

https://zoom.us/u/ajpXpw6w1 mailto:96383123957@zoomcrc.com mailto:mario.avery@fultoncountyga.gov

Any proposals received after this appointed schedule will be considered late and will be returned unopened to the Proposer. The proposal due date can be changed only by addendum.

1.8 CONTACT PERSON AND INQUIRIES

Information regarding the bid or bid requirements, either procedural or technical, may be obtained by submitting questions to:

Purchasing Contact Name: Elsa D. Castro, Chief Assistant Purchasing Agent Email: Elsa.Castro@FultonCountyGa.gov Phone: 404-612-4216

1.9 PROCUREMENT SCHEDULE

The following is the procurement schedule for this project and will be strictly adhered to.

EVENT DATE

RFP Issued Thursday, September 15, 2022 Pre-Proposal Conference at 10:00 AM Thursday, September 29, 2022 Deadline for Submission of Questions and Requests for Clarification by 2:00 PM E.T. Thursday, October 13, 2022

Proposal Due Date by 11:00 A.M. E.T. Thursday, October 20, 2022 Tentative Dates for Oral Interviews/Presentations TBD Anticipated Board of Commissioners Meeting Date November 16, 2022 mailto:Elsa.Castro@FultonCountyGa.gov

SECTION 2 – INSTRUCTIONS TO PROPOSERS

2.1 PROCUREMENT PROCESS

The procurement will be on a formally advertised basis. All technical requirements, unless otherwise specified, must be met, or be capable of being met by the Proposer or their proposal will be disqualified as being non-responsive.

2.2 CONTRACT DEFINITIONS

In addition to any other terms that may be defined in this solicitation and for purposes of this RFP, the following terms and acronyms have the following meaning:

Acronym or Term Name or Definitions

Addendum Revision to the RFP documents issued by the County prior to the receipt of proposals.

Agreement Refers to the executed contract between the County and Contracting Entity.

County Fulton County Government and its authorized representatives

Contact Person Purchasing staff designated by the Fulton County Department of Purchasing and Contract Compliance to submit any questions and suggestions to.

Offeror The entity of individual submitting a proposal in response to this RFP.

Owner Fulton County Government

Proposal The document submitted by the offeror in response to this RFP.

Proposer The entity or individual submitting a proposal in response to his RFP.

Request for Proposal

(RFP)

All documents, whether attached or incorporated by reference, utilized for soliciting sealed proposals.

Responsible Offeror A person or entity that has the capability in all respects to perform fully and reliably the contract requirements.

Responsive Offeror A person or entity that has submitted a bid or proposal that conforms in all material respects to the requirements set forth in the invitation for bids or request for proposals.

Scope of Work

All the services specified, indicated, shown, or contemplated by the Contract, and furnishing by the Contractor of all materials, equipment, labor, methods, processes, construction and manufacturing materials and equipment, tools, plants, supplies, power, water, transportation and other things necessary to complete such services in accordance with the Contract.

Subcontractor/Sub- Consultant

An individual, firm, corporation or any combination thereof having a direct contract with Consultant/Contractor for the performance of a part of the work.

2.3 NO CONTACT DURING PROCUREMENT PROCESS

It is the policy of Fulton County that the evaluation and award process for County contracts shall be free from both actual and perceived impropriety, and that contacts between potential vendors and County officials, elected officials and staff regarding pending awards of County contracts shall be prohibited.

A. No person, firm, or business entity, however situated or composed, obtaining a copy of or responding to this solicitation, shall initiate or continue any verbal or written communication regarding this solicitation with any County officer, elected official, employee, or designated County representative, between the date of the issuance of this solicitation and the date of the County Manager’s recommendation to the Board of Commissioners for award of the subject contract, except as may otherwise be specifically authorized and permitted by the terms and conditions of this solicitation.

B. All verbal and written communications initiated by such person, firm, or entity regarding this solicitation, if same are authorized and permitted by the terms and conditions of this solicitation, shall be directed to the Purchasing Agent.

C. Any violation of this prohibition of the initiation or continuation of verbal or written communications with County officers, elected officials, employees, or designated County representatives shall result in a written finding by the Purchasing Agent that the submitted bid or proposal of the person, firm, or entity in violation is “non-responsive”, and same shall not be considered for award.

2.4 CLARIFICATION & ADDENDA

Proposers may submit requests for clarifications or interpretations regarding this RFP and the Contract.

Proposers must submit such requests through BidNet Direct for the County’s consideration as set forth in this section of this RFP. While the County has not placed an initial limitation on the number of requests which can be submitted, Proposers are cautioned that if Proposers do not request meaningful clarifications or interpretations in an organized manner (e.g., limited frequency of requests), the County will set restrictions on the frequency and number of requests permitted. The County will not respond to requests, oral or written, received after Thursday, October 13, 2022 at 2:00 p.m. local prevailing time.

Proposers are advised that this section places no obligation on the part of the County to respond to any or all requests for clarification or interpretation, and that the County’s failure to respond to any such request will not relieve the Proposer of any obligations or conditions required by this RFP.

All responses to written requests for clarification, interpretation, or additional information will be distributed as addenda to this RFP and posted on BidNet Direct intranet.

No oral interpretation, instruction, or information concerning this RFP given by any employee or agent of the County shall be binding on the County. Proposers who submit a Proposal in reliance on any such oral information risk having their response to this RFP deemed non-responsive by the County. Only written responses issued by addendum to this RFP should be considered by the Proposers.

During the period provided for the preparation of Proposals, the County may issue addenda to this RFP.

These addenda will be numbered consecutively and will be posted on BidNet Direct intranet. These addenda will be issued by, or on behalf of, the County and will constitute a part of this RFP. Each Proposer is required to acknowledge receipt of each addendum by submitting an executed acknowledgment form.

This acknowledgment shall include all addenda distributed prior to the Proposal Submission Date. All responses to this RFP shall be prepared with full consideration of the addenda issued prior to the Proposal Submission Date.

2.5 TERM OF CONTRACT

The period of this Agreement shall consist of a series of Terms as defined below. The County is obligated only to pay such compensation under this Agreement as may lawfully be made from funds budgeted and appropriated for that purpose during the County’s then current fiscal year.

a. Commencement Term

The “Commencement Term” of this Agreement shall begin on the date of execution of the Agreement in the year 2022, the starting date, and shall end absolutely and without further obligation on the part of the County on the 31st day of December, 2022. The Commencement Term shall be subject to events of termination and the County’s termination rights that are described elsewhere in this Agreement. Notwithstanding anything contained in this Agreement, the County’s obligation to make payments provided under this Agreement shall be subject to the County’s annual appropriations of funds for the goods, services, materials, property and/or supplies procured under this Agreement by the County’s governing body and such obligation shall not constitute a pledge of the County’s full faith and credit within the meaning of any constitutional debt limitation.

b. Renewal Terms Unless the terms of this Agreement are fulfilled with no further obligation of the part of either party on or before the final date of the Commencement Term as stated above, or unless an event of termination as defined within this Agreement occurs during the Commencement Term, this Agreement may be renewed at the written option of the County upon the approval of the County Board of Commissioners for three (3) one-year (“Renewal Terms”). However, no Renewal Term of this Agreement shall be authorized nor shall any Renewal Term of this Agreement commence unless and until each Renewal Term has first been approved in writing by the County Board of Commissioners for the calendar year of such Renewal Term. If approved by the County Board of Commissioners, the First Renewal Term shall begin on the 1st day of January, 2023 and shall end no later than the 31st day of December, 2023. If approved by the County Board of Commissioners, the Second Renewal Term shall begin on the 1st day of January, 2024 and shall end no later than the 31st day of December, 2024. Third Renewal Term shall begin on the 1st day of January, 2025 and shall end no later than the 31st day of December, 2025. If the County chooses not to exercise any Renewal Term as provided in this Section, then the Term of this Agreement then in effect shall also be deemed the “Ending Term” with no further obligation on the party of either party.

c. Term Subject to Events of Termination

All “Terms” as defined within this Section are subject to the section of this Agreement which pertain to events of termination and the County’s rights upon termination.

d. Same Terms

Unless mutually agreed upon in writing by the parties, or otherwise indicated herein, all provisions and conditions of any Renewal Term shall be exactly the same as those contained within in this Agreement.

e. Statutory Compliance Regarding Purchase Contracts.

The parties intend that this Agreement shall, and this Agreement shall operate in conformity with and not in contravention of the requirements of O.C.G.A. § 36-60-13, as applicable, and in the event that this Agreement would conflict therewith, then this Agreement shall be interpreted and implemented in a manner consistent with such statute.

2.6 PROPOSAL EVALUATION

All proposals will be evaluated using the criteria specified in Section 4 of this RFP. Each proposal will be reviewed to determine whether it has been submitted in accordance with the proposal requirements.

Proposals deemed non-responsive will be rejected from further review and the Offeror will be advised in writing.

Proposals deemed responsive will be evaluated based on the evaluation criteria set forth in this RFP.

The County will determine which proposals are reasonably susceptible of being selected for award based on the evaluation criteria. The County may also conduct oral presentations/interviews.

Selection will include an analysis of proposals by an Evaluation Committee composed of County personnel who will review the proposal submittals in accordance with the submittal requirements and the evaluation criteria set forth in Section 4 of this RFP. The committee may request oral interviews and/or site visits. The County will determine which proposals are reasonably susceptible of being selected for award based on the evaluation criteria. Other factors, as detailed in the RFP, will be considered in determining what proposal will be deemed to best meet the needs of Fulton County. Awards will not necessarily be based on cost alone.

2.7 DISQUALIFICATION OF PROPOSERS

The submission of more than one (1) proposal to the County as the primary Proposer or member of a joint venture for the same work by and individual firm, partnership or corporation under the same or different names may be grounds for disqualification of a Proposer and the rejection of the proposal.

2.8 RESERVED RIGHTS

The County reserves the right to accept or reject any and/or all proposals, to waive irregularities and technicalities, and to request resubmission. Any sole response that is received may or may not be rejected by the County depending on available competition and timely needs of the County. There is no obligation on the part of the County to award the contract to the lowest proposer and the County reserves the right to award the contract to the responsible proposers submitting responsive proposals with resulting agreements most advantageous and in the best interest of the County. The County shall be the sole judge of the proposals and the resulting agreements that are in its best interest and its decision shall be final. Also, the County reserves the right to make such investigation as it deems necessary to determine the ability of any proposer to perform the work or service requested. Information the County deems necessary to make this determination shall be provided by the proposer. Such information may include, but shall not be limited to, current financial statements by an independent CPA; verification of availability of personnel; and past performance records.

2.9 APPLICABLE LAWS

All applicable laws and regulations of the State of Georgia and ordinances and regulations of Fulton County shall apply. Protestors shall seek resolution of their complaints in the manner provided in the Fulton County Purchasing Code Section 102-448 which is incorporated by reference herein.

2.10 INSURANCE AND RISK MANAGEMENT PROVISIONS

Insurance and Risk Management provisions and Indemnification and Hold Harmless provisions are outlined in Section 7 of this RFP.

Upon award, the successful Proposer must obtain at their expense, a Certificate of Insurance (“COI”) with policy limits equal to or greater than the limits outlined in Section 7. Proof of insurance must be provided to the County prior to the start of any activities/services as described in the bid document(s). Any and all insurance coverage(s) and/or bonds required under the terms and conditions of the contract shall be maintained during the entire term of the contract, including any extensions or renewals thereto, and until all work has been completed to the satisfaction of the County.

2.11 ACCURACY OF RFP AND RELATED DOCUMENTS

The County assumes no responsibility that the specified technical and background information presented in this RFP, or otherwise distributed or made available during this procurement process, is complete or accurate. Without limiting the generality of the foregoing, the County will not be bound by or be responsible for any explanation or interpretation of the Proposal documents other than those given in writing as an addendum to this RFP.

Should a recipient of this RFP find discrepancies in or omissions from this RFP and related documents, the recipient of this RFP shall immediately notify the Purchasing Contact Person identified in Section 1.9 A written addendum, if necessary, will be made available to each recipient of this RFP.

2.12 RESPONSIBILITY OF PROPOSER

Each Proposer is encouraged to conduct all necessary investigations and review all available and relevant data and information, which are necessary in its judgment in order to assume this responsibility prior to the submittal of its Proposal. Proposers are reminded of Fulton County’s “No Contact During Procurement” policy and shall only contact the person designated by the RFP.

2.13 CONFIDENTIAL INFORMATION

If any Proposal contains technical, financial, or other confidential information that the Proposer believes is exempt from disclosure, the Proposer must clearly label the specific portions sought to be kept confidential and specify on what the exemption is based. The County, at its sole discretion and subject to applicable law, will determine whether such exemption applies. The County has sole discretion to make such determination regarding the disclosure of information, and by responding to this RFP, Proposers waive any challenge to the County’s decisions in this regard. Marking all or substantially all of a Proposal as confidential may result in the Proposer being deemed non-responsive to this RFP.

Notwithstanding the foregoing, Proposers recognize and agree that the County, its staff, and its Consultants will not be responsible or liable in any way for any losses that the Proposer may suffer from the disclosure of information or materials to third parties.

2.14 COUNTY RIGHTS AND OPTIONS

This RFP constitutes an invitation to submit Proposals to the County. Without limitation or penalty, the County reserves and holds at its sole discretion, the following rights and options:

• This RFP does not obligate the County to select, procure or contract for any services whatsoever.

• Fulton County reserves the right to award a contract based on this RFP and the proposal(s) received (in whole or in part) to one or several vendors.

• The County reserves the right to change or alter the schedule for any events associated with this procurement and, if required, notify the Proposers. A Proposer, by submitting a Proposal, agrees to be bound by any modifications made by the County

• All costs incurred by a Proposer in connection with responding to this RFP, the evaluation and selection process undertaken in connection with this procurement, and any negotiations with the County will be borne by the Proposer.

• The County reserves the right to reject all Proposals and components thereof to eliminate all Proposers responding to this RFP from further consideration for this procurement, and to notify such Proposers of the County's determination.

• The County may cancel this RFP without the substitution of another RFP and terminate this procurement at any time without any liability whatsoever.

• The County reserves the right to waive any technicalities or irregularities in the Proposals.

• The County reserves the right to eliminate any Proposer who submits incomplete or inadequate responses or is not responsive to the requirements of this RFP.

• The County may request Proposers to send representatives to the County for interviews and presentations.

• To the extent deemed appropriate by the County, the County may select and enter into discussion and negotiations with the Proposer(s) submitting Proposal(s), which are found to be reasonably susceptible for award.

• The County reserves the right to discontinue negotiations with any selected Proposer.

• The County reserves the right, without prior notice, to supplement, amend, or otherwise modify this

RFP.

• All Proposals (other than portions thereof subject to patent or copyright protection) become the property of the County and will not be returned, and the County reserves the right to utilize all such information contained in the Proposals without further cost to the County

• The County may add to or delete from the Project Scope of Work set forth in this RFP.

• Any and all Proposals not received by the Proposal Submission Date shall be rejected and returned unopened.

• Neither the County, its staff, its representatives, nor any of its consultants or attorneys will be liable for any claims or damages resulting from the solicitation, collection, review, or evaluation of responses to this RFP.

• The County, including its representatives and consultants, reserves the right to visit and examine any of the facilities referenced in any Proposal and to observe and investigate the operations of such facilities.

By responding to this RFP, Proposers acknowledge and consent to the rights and conditions set forth in this RFP.

2.15 COST OF PROPOSAL PREPARATION AND SELECTION PROCESS

Each Proposal, including preparation of all information required to be included in a Proposal pursuant to this RFP, shall be prepared at the sole cost and expense (including, but not limited to, engineering and legal costs) of the Proposer. In addition, the Proposer shall be solely responsible for all costs (including engineering and legal costs) incurred by such Proposer in connection with this selection process, including any costs incurred by the Proposer in any subsequent negotiations entered into in connection with developing the Proposal. There shall be no claims whatsoever against the County, its staff, or its consultants for reimbursement for the costs or expenses (including, but not limited to, engineering and legal costs) incurred during the preparation of the Proposal or other information required by this RFP or procurement process or in connection with the selection process or any negotiations.

2.16 TERMINATION OF NEGOTIATIONS

The County at its sole discretion may, at any time, to the extent permitted by Applicable Law, exclude a Proposer from further participation in any negotiation process if the County determines that such Proposer is failing to progress in the negotiations or if the terms of its Proposal are less advantageous than those of other Proposers and such Proposer is deemed to be no longer susceptible of selection.

The County will give written notice of its decision to the Proposer, which shall be sent in writing, signed by the County.

2.17 WAGE CLAUSE

Pursuant to 102-413, each Contractor shall agree that in the performance of the Contract he will comply with all lawful agreements, if any, which the Contractor had made with any association, union, or other entity, with respect to wages, salaries, and working conditions, so as not to cause inconvenience, picketing, or work stoppage.

2.18 ADDITIONAL OR SUPPLEMENTAL INFORMATION

After receipt of the submittals, the County will evaluate the responses, including the references, financial statements, experience and other data relating to the Respondent’s qualifications. If requested by the Department of Purchasing and Contract Compliance, Respondent’s maybe required to submit additional or supplemental information to determine whether the Respondent meets all of the qualification requirements.

2.19 REPORTING RESPONSIBILITIES

The successful Proposer will report directly to the Chief Information Officer or designated representative.

2.20 GEORGIA SECURITY AND IMMIGRATION COMPLIANCE ACT

This Request for Proposal is subject to the Georgia Security & Immigration Compliance Act. Effective July 1, 2013, bidders and proposers are notified that all bids/proposals for services that are to be physically performed within the State of Georgia must be accompanied by proof of their registration with and continuing and future participation in the E-Verify program established by the United States Department of Homeland Security. Physical performance of services means any performance of labor or services for a public employer using a bidding process or by contract wherein the labor or services exceed $2,499.99 (except for services performed by an individual who is licensed pursuant to Title 26, Title 43, or the State Bar of Georgia).

A completed affidavit must be submitted on the top of the bid/proposal at the time of submission, prior to the time for opening bids/proposals. Under state law, the County cannot consider any bid/proposal which does not include a completed affidavit. It is not the intent of this notice to provide detailed information or legal advice concerning the Georgia Security & Immigration Compliance Act. All bidders/proposers intending to do business with the County are responsible for independently apprising themselves and complying with the requirements of that law and its effect on County procurements and their participation in those procurements. For additional information on the E-Verify program or to enroll in the program, go to: https://e-verify.uscis.gov/enroll.

The Chief Purchasing Agent of Purchasing & Contract Compliance is authorized to conduct random audits of a contractor’s or subcontractors’ compliance with the Illegal Immigration Reform and Enforcement Act and the rules and regulations of the Georgia Department of Labor.

See Section 5, Proposal Forms for declarations and affidavits.

2.21 AUTHORIZATION TO TRANSACT BUSINESS

If the Proposer is a Georgia corporation, the corporation, prior to contract execution, shall submit documentary evidence from the Secretary of State that the Corporation is in good standing and that the corporation is authorized to transact business in the State of Georgia.

If the Proposer is a foreign (non-Georgia) corporation, the corporation, prior to contract execution shall submit a Certificate of Authority and documentary evidence from the Georgia Secretary of State of good standing which reflects that the corporation is authorized to do business in the State of Georgia.

2.22 RIGHT TO PROTEST

Any actual bidder or offeror that has submitted a bid/proposal for a particular procurement and is aggrieved in connection with the solicitation or award of the contract shall protest in writing to the purchasing agent after the date that the specific bid or proposal is submitted. No protest will be accepted or considered prior to the date the specific bid or proposal is submitted; it will be considered untimely. All protests shall set forth in full detail the factual and legal bases for the protest and specific relief sought by the protestor. Protests arising from factual or legal bases that the protestor knew or should have known prior to the submission of the bid/proposal must be submitted within three business days of the submission of the bid/proposal. Protests arising from factual or legal bases that the protestor knew or should have known subsequent to the date the bid/proposal was submitted must be submitted within ten business days after the protestor knew or should have known of such bases, but in no event shall any protest be submitted more than ten business days after the award of the contract. Untimely protests will not be considered by the purchasing agent and will be simply denied as untimely. Decisions on timeliness by the purchasing agent are not appealable. An oral protest or a protest to an official, employee, User Department, or other person apart from the Chief Purchasing Agent of Purchasing & Contract Compliance does not comply.

2.23 NON-COLLUSION

By submitting a signed proposal, Offeror certifies and attests that there has been no collusion with any other Offeror. Reasonable grounds for believing Offeror has an interest in more than one proposal will result in rejection of all proposals in which the Offeror has an interest. Any party to collusion may not be considered in future proposals for the same or similar work.

2.24 CERTIFICATE OF ACCEPTANCE

By responding to this RFP, Offeror acknowledges that he/she has read this solicitation document, including any addenda, exhibits, attachments, and/or appendices in its entirety, and agrees that no pages or parts of the document have been omitted, that he/she understands, accepts and agrees to fully comply with the requirements therein.

Offeror also certifies and attests that the Offeror has reviewed the form Fulton County contract included in this solicitation and agrees to be bound by its terms, or that the Offeror certifies that it is submitting any proposed modification(s) to the contract terms with its proposal in accordance with Section 2.25, Exceptions to the County’s Contract. The Offeror further certifies that the failure to submit proposed modifications with the proposal waives the Offeror’s right to submit proposed modifications later. The Offeror also acknowledges that the indemnification and insurance provisions of Fulton County’s contract included in this solicitation document are non-negotiable and that proposed modifications to said terms may be reason to declare the Offeror’s proposal as non-responsive.

2.25 EXCEPTIONS TO THE COUNTY’S CONTRACT

If Offeror takes exception to any term or condition set forth in the Sample Contract, see Section 8 of this RFP, and any of its exhibits, appendices or attachments, said exceptions must be clearly identified in the response to this RFP. Exceptions or modifications to any of the terms and conditions must be submitted as a separate document accompanying the Offeror’s proposal clearly marked as “Exceptions.”

The County shall be the sole determiner of the acceptability of any exception(s).

2.26 CERTIFICATION REGARDING DEBARMENT

By responding to this RFP, Offeror certifies that neither it or its subcontractors is presently debarred, suspended, proposed for debarment, declared ineligible, or otherwise excluded from doing business with any government agency. Any such exclusion may cause prohibition of your firm from participating in any procurement by the County. Section 102-449 of the Fulton County Code of Laws, which is incorporated as if fully set forth herein, establishes the procedure for the debarment of contractors.

2.27 INTERGORVERNMENTAL COOPERATIVE PROCUREMENT STATEMENT

The County through the Department of Purchasing & Contract Compliance grants to any public serving governmental agency, authorization to purchase equivalent services or products described herein with this solicitation at the same submitted unit bid price, terms and conditions, but only with the consent of the Contractor/Consultant/ Service Provider. Public agencies shall have the ability to purchase the awarded goods and services from the awarded Contractor(s)/Consultant(s)/Service Provider(s) under the terms and conditions of the resultant contract. Any purchases shall be between the Contractor/Consultant/Service Provider and the participating public agency and shall not impact the Contractor’s/Consultant’s/Service Provider’s obligation to the County. Any estimated purchase volumes listed herein do not include other public agencies and the County makes no guarantee as to their participation.

2.28 GENERAL REQUIREMENTS

1. Proposals may be withdrawn upon receipt of a written request prior to the stated due date and time.

If a firm seeks to withdraw a proposal after the due date and time, the firm must present a notarized statement indicating that an error was made, with an explanation of how it occurred. The withdrawal request must be accompanied by documentation supporting the claim. Prior to approving or disapproving the request, an opinion will be obtained from Fulton County’s Legal Counsel indicating whether the firm is bound by its proposal.

Proposals for projects that are solicited pursuant to the Georgia Local Government Public Works Construction Law (O.C.G.A. § 36-91-1 et seq.) may be withdrawn as follows:

The County must advise Offerors in the request for proposals of the number of days that Offerors will be required to honor their proposals. If an Offeror is not selected within 60 days of opening the proposals, any Offeror that is determined by the governmental entity to be unlikely of being selected for contract award will be released from the proposal.

2. Fulton County shall be the sole judge of the quality and the applicability of all proposals. Design, features, overall quality, local facilities, terms and other pertinent considerations will be taken into account in determining acceptability.

3. The successful Offeror must assume full responsibility for delivery of all goods and services proposed.

4. The successful Offeror must assume full responsibility for replacement of all defective or damaged goods and/or performance of contracted services within thirty (30) days’ notice by the County of such defect, damage or deficiency.

5. The successful Offeror must assume full responsibility for providing warranty service on all goods, materials, or equipment provided to the County with warranty coverage. Should a vendor be other than the manufacturer, the vendor and not the County is responsible for contacting the manufacturer.

The Offeror is solely responsible for arranging for the service to be performed.

6. The successful Offeror shall be responsible for the proper training and certification of personnel used in the performance of the services proposed.

7. The successful Offeror shall not assign, transfer, convey, sublet, or otherwise dispose of any contract resulting from the RFP or of any of its rights, title or interest therein without prior written consent of the Fulton County Board of Commissioners.

8. In case of default by the successful Offeror, Fulton County may procure the articles or services from another source and hold the successful Vendor responsible for any resultant excess cost.

9. All proposals and bids submitted to Fulton County are subject to the Georgia “Open Records Act”, Official Code of Georgia, Annotated (O.C.G.A.) § 50-18-70 et seq.

10. All proposals and bids submitted to Fulton County involving Utility Contracting are subject to the Georgia law governing licensing of Utility Contractors, O.C.G.A. §43-14-8.2(h).

SECTION 3 – PROPOSAL REQUIREMENTS

3.1 OVERVIEW OF PROPOSAL REQUIREMENTS

Proposers shall submit Proposals in accordance with the content and format requirements set forth in this RFP. Proposals should be clearly organized and structured in a manner that allows materials included in the document to be located easily.

Each of the instructions set forth in this section must be followed for a Proposal to be deemed responsive to this RFP. In all cases, the County reserves the right to determine, at its sole discretion, whether any aspect of the Proposal meets the requirements set forth in this section. The County reserves the right to reject any Proposal, which in its judgment, does not comply with these Proposal submission requirements.

3.2 FORMAT & PROPOSAL SUBMISSION INSTRUCTIONS

3.2.1 Submission Instructions: Submit one (1) original, signed and dated proposal response in PDF Format electronically on-line through BidNet Direct at https://www.bidnetdirect.com/georgia/fultoncounty on the forms provided in the solicitation document.

All Proposals, including all attachments, must be received by the County through BidNet Direct no later than Thursday, October 20, 2022 by 11:00 A.M.

All submitted responses will be electronically time and date stamped at the time all documents are uploaded and received.

3.2.2 Required Submittals: The bidder must complete and execute the following documents and upload as required:

1. Georgia Security and Immigration Contractor Affidavit and Agreement

2. Georgia Security and Immigration Subcontractor Affidavit

3. Technical Proposal – Format the proposal with the following labeled sections:

a. Section 1 – Executive Summary

b. Section 2 – Project Plan, Technical Approach

c. Section 3 – Project Team Qualifications/ Qualifications of Key Personnel

d. Section 4 – Relevant Project Experience

e. Section 5 – Availability of Key Personnel

f. Section 6 – Local Preference

g. Section 7 – Service Disabled Veterans Preference

4. Purchasing Forms

5. Contract Compliance Forms

6. Proof of Insurance

7. Acknowledgement of each Addendum

8. Cost Proposal

9. Requirement Matrix

Any proposal responses received after the stated time and date will not be considered. It shall be the sole responsibility of the proposer to have his/her proposal response submitted through BidNet Direct to the County for receipt on or before the stated time and date.

Proposal(s) shall be publicly opened via web conferencing, with only the names of the Proposers disclosed at the opening.

Date: Thursday, October 20, 2022

Time: 11:05 am

Web Conference Link: https://zoom.us/j/99974881278

Meeting ID: 999 7488 1278

One tap mobile

+14702509358,,99974881278# US (Atlanta)

+14703812552,,99974881278# US (Atlanta)

Dial by your location

+1 470 250 9358 US (Atlanta)

+1 470 381 2552 US (Atlanta)

+1 301 715 8592 US (Washington DC)

+1 312 626 6799 US (Chicago)

+1 646 518 9805 US (New York)

+1 646 558 8656 US (New York)

+1 651 372 8299 US (Minnesota)

+1 786 635 1003 US (Miami)

+1 267 831 0333 US (Philadelphia)

+1 206 337 9723 US (Seattle)

+1 213 338 8477 US (Los Angeles)

+1 253 215 8782 US (Tacoma)

+1 346 248 7799 US (Houston)

+1 602 753 0140 US (Phoenix)

+1 669 219 2599 US (San Jose)

+1 669 900 9128 US (San Jose)

+1 720 928 9299 US (Denver)

+1 971 247 1195 US (Portland)

Meeting ID: 999 7488 1278

Find your local number: https://zoom.us/u/adBIaIOW8E

Join by SIP

99974881278@zoomcrc.com

Join by H.323

162.255.37.11 (US West)

162.255.36.11 (US East)

115.114.131.7 (India Mumbai)

115.114.115.7 (India Hyderabad)

213.19.144.110 (Amsterdam Netherlands) https://zoom.us/j/99974881278 https://zoom.us/u/adBIaIOW8E mailto:99974881278@zoomcrc.com

213.244.140.110 (Germany)

103.122.166.55 (Australia Sydney)

103.122.167.55 (Australia Melbourne)

149.137.40.110 (Singapore)

64.211.144.160 (Brazil)

149.137.68.253 (Mexico)

69.174.57.160 (Canada Toronto)

65.39.152.160 (Canada Vancouver)

207.226.132.110 (Japan Tokyo)

149.137.24.110 (Japan Osaka)

Meeting ID: 999 7488 1278

3.3 SCOPE OF WORK

Fulton County Government is seeking to implement a new vulnerability scanning and assessment tool as part of its vulnerability management program. The tool will be expected to meet or exceed the following specifications and requirements Asset Discovery and Information Gathering

a. Information Gathering. tool can gather information about a system. Indicate what techniques your tool supports, such as whois, DNS, and IP assignments.

b. Asset Identification

• tool can perform identification of organization assets such as:

• Traditional network devices: workstations, servers, desktops, copiers, routers, switches, etc.

• Mobile devices: smart phones, laptops, tablets, etc.

• Cloud environments: web applications, hosted storage, hosted platforms, etc.

• Hosts in targeted subnets

c. Asset Information

• tool can identify information and systems on the identified assets such as:

• Latest OS

• All applications on a device/host

• All devices/hosts

• Services

• Vulnerabilities

d. Asset Discovery Techniques

• Tool must use multiple asset discovery techniques and methods. Indicate what discovery techniques your tool supports

• Banner grabbing and binary grabbing

• OS-specific protocols

• TCP/IP stack fingerprinting

• Passive techniques such as packet spoofing

• Data fingerprinting

• Asset Categorization Tool can support categorizing of identified assets. Indicate if asset categorization is done in real time or near real time. Indicate what attributes are used to categorize an asset (e.g. OS, location, MAC address, types of device).

e. Asset Tagging

• Tool is able to tag and thus organize assets into groups such as device type, similar business impacts, or some other organization-defined characteristics. The tool must be able to:

• Assign tags in real time

• Modify and customize tags

• Automatically tag assets based on some predefined attributes

• Dynamically tag assets with customizable rules

• Automatically group assets based on characteristics

• Enable group scanning, reporting, and remediating based on asset tags Asset Cataloging

• Indicate which of the following attributes are recorded as part of the cataloging of assets:

• IP address ranges

• Corresponding systems

• System owners

• Latest OS

• All applications on a device/host

• All devices/hosts

• Services

• Vulnerabilities Vulnerability Database Coverage

Database Support

• Tool must support third-party vulnerability databases or third-party information databases to enhance vulnerability detection; Indicate which does the tool support:

• Common Vulnerabilities and Exposures (CVE)

• Open Vulnerability and Assessment Language (OVAL)

• Open Source Vulnerability Database (OSVDB)

• SANS Institute

• FBI Top 20-

• United States Government Configuration Baseline (USGCB)

• Center for Internet Security (CIS)

• Defense Information Systems Agency (DISA) Security Technical Implementation Guide

(STIG)

• Open Web Application Security Project (OWASP)

• National Vulnerability Database (NVD)

• United States Computer Emergency Readiness Team (CERT) Vulnerability Database

• Exploit database that collects Proof of Concepts (e.g. www.exploits-db.com)

• Frequency of Updates. Indicate how frequently the tool will be updated with identified vulnerability signatures or other detection attributes. Specify how these update frequencies vary based on the deployment option of the tool.

• Emergency Updates. Indicate if there is a process for emergency updates to the tools in the face of high-impact vulnerabilities (e.g.,solarwinds,log4j).

Vulnerability Detection

• Indicate which of the following detection methods your tool supports. If you support any of the following, please describe how:

• Configuration auditing

• Patch auditing

• Target profiling

• Browser-based scanning

• Perimeter monitoring

• SSL Validation

• Certificate validation

• Incorrect configuration uses

• Expired/outdated

• Self-authenticated

• Weak ciphers

• Certificates signed by untrusted third parties

• Web log analysis

• File integrity monitoring

• Process and system monitoring

• Endpoint monitoring

• Application monitoring

• User activity monitoring

• Configuration assessment/policy configuration assessment/policy configuration management

• Remotely assess and verify settings, such as configuration settings or password complexity of a domain group policy

• OS discovery and assessment techniques

• Banner grabbing

• Binary grabbing

• OS specific protocols

• TCP/IP stack fingerprinting

• OS fingerprinting – identifying the version type and any services running on the system

• Packet spoofing

• TCP and UDP…