RFP__PR9041_Cybersecurity_Governance_Risk__Compliance_Solution.pdf

RFP PR9041

For

Cybersecurity Governance, Risk, and Compliance Solution Platform

Issue Date: July 27, 2026

Pre-response Conference: Not Mandatory Attendance

Pre-response Conference Date: August 4, 2026

Questions/Comments Due Date: August 7, 2026

Addendum Due Date: August 13, 2026

Proposal Due Date: August 27, 2026 by 2:00 PM EST

Bid Bond: Not Required Payment & Performance Bond: Not Required

Direct all inquiries to Buyer of Record:

Al Segura

407-434-2974 asegura@ouc.com

Orlando Utilities Commission RFP PR9041 – Cybersecurity Governance, Risk, and Compliance Solution Platform

SCM-RFP-T-01 – Request for Proposal Template v5.0 – 5/22/25

Orlando Utilities Commission Orlando, Florida

RFP PR9041 for Cybersecurity Governance, Risk, and Compliance Solution Platform

Table of Contents 1 Introduction

1.1 Scope of Work Summary

1.2 Pre-Response Conference

1.3 Term of Contract

1.4 Minimum Bidder Qualifications

1.5 Price and Costs

1.6 Terms and Conditions

1.7 Contract Sample

1.8 Proposal Evaluation Criteria

2 Bidder Requirements and Qualifications

2.1 Detailed Scope, Requirements, & Drawings

2.2 Bidder Information & Required Bidder Qualifications

2.2.1 Bidder Information

2.2.2 Required Bidder Qualifications

3 Instructions to Bidders

3.1 Legal and Public Record Statement

3.2 Confidentiality Notice to Bidders

3.2.1 Exemptions

3.3 Acknowledgement

3.3.1 Statement of No Bid

3.4 General Information

3.4.1 Common Terms

3.4.2 Submittal

3.4.2.1 Alternate Proposals

3.4.3 Signatures

3.4.4 Withdrawal

3.5 Electronic Submittal of the Proposal

SCM-RFP-T-01 – Request for Proposal Template v5.0 – 5/22/25

3.6 Compliance Forms

3.6.1 Public Entity Crimes

3.6.2 Dispute Disclosure

3.7 RESERVED

3.8 Proposal Preparation Costs

3.9 Exceptions

3.10 Clarifications

3.11 Local Conditions

3.12 Opening

3.13 Solicitation Selection Schedule

3.14 Proposal Acceptance and Rejection

3.15 Proposal Evaluation Criteria

3.16 Cancelation

3.17 Freight (If Applicable)

3.18 Bid Bond (If Applicable)

3.19 Payment and Performance Bond (If Applicable)

3.20 Contract Execution

3.21 Award

3.22 Taxes, Permits, and Licenses

3.23 Error and Omissions

3.24 Proposal Submittal Format

3.24.1 OUC Policies and Procedures for Bidders

3.25 Signatures

4 Proposal Submittal Format & Checklist

5 Attachments

SCM-RFP-T-01 – Request for Proposal Template v5.0– 5/22/25

Re qu es t f or P ro po sa l (

RF

P)

Orlando Utilities Commission Orlando, Florida

RFP PR9041 for Cybersecurity Governance, Risk, and Compliance Solution Platform

Direct all inquiries to the Buyer of Record: Al Segura

407-434-2974 asegura@ouc.com

Proposal Opening Location: Orlando Utilities Commission Reliable Plaza 100 West Anderson Street Orlando, Florida 32801

1. Instructions are located in the Instruction to Bidders section of this document; or, may be provided during a Pre-Conference Meeting.

2. Electronic proposal submittals, described in the Electronic Submittal of the Proposal section of this document, will be accepted. Email or other means will not be accepted.

3. VendorLink help can be accessed by calling 407-222-1885, or by emailing support@evendorlink.com.

mailto:support@evendorlink.com

SCM-RFP-T-01 – Request for Proposal Template v5.0– 5/22/25

1 INTRODUCTION

The Orlando Utilities Commission (OUC) is an electric and water municipal utility serving Orlando, Florida and portions of surrounding Orange County. OUC also has an Inter-local agreement with the City of St.

Cloud, Florida for the management of its electric utility. Currently, OUC serves more than 380,000 customers. To obtain general information about OUC, access www.ouc.com.

1.1 SCOPE OF WORK SUMMARY

The purpose of this RFP is to invite qualified suppliers to prepare and submit proposals to identify an comprehensive Cybersecurity Governance, Risk, and Compliance Solution that includes implementation, project management, training, post implementation support, and professional services.

The selected solution shall support the full risk management lifecycle, including preparation, risk assessment, risk analysis, risk evaluation, risk treatment, monitoring, and ongoing communication with stakeholders. The solution must enable OUC to consistently identify, assess, document, prioritize, and manage risks across information technology (IT), business areas, third-party relationships, and enterprise business processes and provide centralized capabilities for managing third-party risk management (TPRM), criticality impact assessments, preliminary risk analysis, threat risk assessments, and a centralized enterprise risk register with reporting capabilities.

Proposers are encouraged to be innovative in their proposed solutions as to provide the most cost-effective solution while meeting the requirements outlined in this proposal.

Shortlisted vendors will be expected to accommodate a complete demo or pilot which must include all the required services, either via the web or in person demonstrating specific capabilities of your solution. You will be asked to demonstrate certain features within your system test of OUC provided data transfer and product functionality. (This demo will provide OUC with an important means for evaluating the product and awarding the contract).

OUC INFORMATION SECURITY: This section is to provide the Proposers with information concerning the expected security activities, standards, and controls to take place during the project with the goal of creating a secure application. These items reduce risks associated with inadequate information security. Information security is concerned with data confidentiality, integrity, and availability in all states including data in motion (transmission), in process, and at rest (stored).

OUC also requests information on the following items to assist us in choosing the best solution options for OUC:

• Product licensing, maintenance, and support

• Service Level Agreement (SLA)

• Cybersecurity and infrastructure hardening

• Product functional/technical project team training including Train-the-Trainer

• Product upgrade, patching, and bug fix approaches

• Environment management and refresh approach, i.e. for Test and Production

Proposers will be responsible for reviewing all OUC Information Security documents and standards.

Proposers will abide by OUC standards and policies including the following, which are found in VendorLink:

http://www.ouc.com/

SCM-RFP-T-01 – Request for Proposal Template v5.0– 5/22/25

Exhibit 1 Terms and Conditions Principles for a Cloud Hosted Solution

Exhibit 2 Sample - OUC SOFTWARE LICENSE TERMS AND CONDITIONS REV 5-21-21

OUC does not guarantee any number of products and/or services to be awarded under this RFP.

Refer to Section 2.1, Detailed Scope, Requirements, & Drawings for more information.

1.2 PRE-RESPONSE CONFERENCE

To comply with security requirements, email names of attendees and company affiliations to the Buyer of Record at least 48 hours in advance of the meeting. Please bring government issued photo identification the day of the Pre-Response Conference.

If applicable, refer to Attachment C: Invitation to Pre-Response Conference

1.3 TERM OF CONTRACT

The agreement will be for an initial term of three (3) years, with two (2) additional one-year renewals at the option for OUC.

1.4 MINIMUM BIDDER QUALIFICATIONS

In addition to the required Proposers Qualifications listed in 2.2, Proposer’s shall provide the following information as part of their Proposal:

1. A cover letter signed by an officer of the company attesting to the information provided within the proposal.

2. Team’s qualifications – include resumes for key resources.

3. A project Gantt with the timeline for the implementation.

4. A first draft of the Statement of Work (SOW) for an initial understanding of the effort.

5. An Executive Summary/Corporate Overview.

6. A list of the number of offices / locations.

7. List the number of employees: ________

8. Website URL: _________________________________________________

9. Is the firm licensed to conduct business in the State of Florida?

a. If Yes, provide proof of registration with the Florida Department of State – Division of Corporations.

b. If not, OUC requires that the Bidder be registered to do business in the State of Florida by the time Notice of Intent to Award is sent. The link to the site is: http://www.sunbiz.org.

10. Is your firm currently involved in any unsettled litigation?

a. If yes, please explain:

11. Has your firm ever been issued a warning or violation by a regulatory agency for noncompliance with Federal or State regulations?

a. If yes, provide dates and explain.

12. Does your firm have employee incentive programs to reward safety, productivity, quality, performance, and/or longevity?

SCM-RFP-T-01 – Request for Proposal Template v5.0– 5/22/25

a. If so, describe.

13. Have you ever had a contract terminated?

a. If yes, provide the name of the company, when the event happened, and reasons.

14. Do you have a Training Program for your employees?

a. If yes, please provide an outline or attach a copy of program.

15. Does your firm have an affirmative action plan in utilizing small business / minority / disadvantaged entrepreneur and local participation in pre-qualifying suppliers and subcontractors?

a. If yes, describe plan and provide possible recommendations to promote the hiring and training of minority/disadvantage workers.

16. Does your firm have a Drug Free Workplace Policy?

a. If yes, provide a brief summary and/or copy of your Policy.

17. Does your Firm perform any or all of the following employee pre-screening requirements:

a. Drug Screening Tests: Yes ( ); No ( )

b. Workers’ Compensation History Review: Yes ( ); No ( )

c. Driver’s License Verification: Yes ( ); No ( )

d. Pre-employment Physical Exam: Yes ( ); No ( )

e. Criminal History Review: Yes ( ); No ( )

1.5 PRICE AND COSTS

Prices documented in the submitted Proposal must remain firm throughout the contract period (including additional extensions, if applicable). Refer to Attachment B: Price Schedule.

1.6 TERMS AND CONDITIONS

1.7 Proposer must provide for OUC’s attorneys review all the applicable Terms and Conditions for the proposed platform, maintenance & support, and professional services. Also, review OUC’s Software License Terms and Conditions.

1.8 CONTRACT SAMPLE

Click here to view an OUC contract sample.

1.9 PROPOSAL EVALUATION CRITERIA

Refer to the Instructions to Bidders section of this document.

http://www.ouc.com/docs/procurement/proc_contract_agreement.pdf?sfvrsn=2

SCM-RFP-T-01 – Request for Proposal Template v5.0– 5/22/25

2 BIDDER REQUIREMENTS AND QUALIFICATIONS

2.1 DETAILED SCOPE, REQUIREMENTS, & DRAWINGS

Please refer to the applicable Attachment for detailed scope:

• Attachment A Detailed Specifications

2.2 BIDDER INFORMATION & REQUIRED BIDDER QUALIFICATIONS

2.2.1 Bidder Information

On company letterhead Bidder to provide a response cover page with the following information:

1. Firm Name

2. Name of Parent Company if applicable

3. Complete Business Address

4. State of Incorporation

5. Number of years in business

6. Name(s) and contact information of key personnel

7. Dun & Bradstreet number

8. Licenses obtained to conduct business with OUC

2.2.2 Required Bidder Qualifications

Refer to Section 1.4 Minimum Bidder Qualifications for more information.

1. List the number of projects (with similar scope and size) that the bidding organization has completed and are in progress.

2. Provide at least three (3) references with contact information related to completed projects with the similar scope and size project.

a. If deemed pertinent, OUC will request to do site visits to customers provided as references by selected Bidder or Bidder’s affiliates.

3. Provide a complete list of all the subcontractors that may be part of the project, with the following information:

a. Company name

b. Contact information

c. Number of years in business

d. Proof of the necessary licenses for the job (if applicable)

e. List of project that they had participated with similar scope and size to this RFP

SCM-RFP-T-01 – Request for Proposal Template v5.0– 5/22/25

4. Should bidder be awarded the work in this RFP, please provide information on any Economic Development Opportunities that Bidder may bring, such as the creation of new jobs or purchasing or leasing of new building space, which could benefit the local Orlando Area or the State of Florida.

SCM-RFP-T-01 – Request for Proposal Template v5.0– 5/22/25

3 INSTRUCTIONS TO BIDDERS

3.1 LEGAL AND PUBLIC RECORD STATEMENT

As required by Florida’s Public Records Law, information provided to OUC in the course of business will be made available for public inspection and copying unless a specific statutory exemption applies.

3.2 CONFIDENTIALITY NOTICE TO BIDDERS

By submitting a proposal to OUC, each Bidder acknowledges and understands that OUC is a public agency subject to Chapter 119 Florida Statutes (“Public Records Law”). Any Proposal document the Bidder submits will become a public record when OUC provides notice of an intended decision or 30 days after opening the bids, proposals, or final replies, whichever is earlier. Trade Secrets, certain background financial information, and other items, may constitute exemptions to disclosure under the Public Records law.

3.2.1 Exemptions

If during the Proposal or Negotiation Phase a Bidder wishes to claim an exemption on any portion of its Proposal to OUC, the Bidder must identify the specific statutory exemption and do the following:

1. Submit a redacted version. Redact (black out) only those portions of the Proposal put forward for exemption.

2. Submit an un-redacted version of the same documents marked, “Confidential –Trade Secret/ Proprietary Information”. Both versions are to be submitted at the same time.

3.3 ACKNOWLEDGEMENT

1. From the issue date of this solicitation packet until a selection decision is made, no unauthorized contact related to this solicitation will be allowed between a Bidder, their employees or subcontractors and any OUC commissioner, officer, director, or staff, with the exception of the Buyer of Record. Any unauthorized contact will disqualify the Bidder from further consideration

2. The selected Bidder agrees to obtain, prior to award, Worker's Compensation, General Liability, Automotive, and other insurance requirements in accordance to the requirements in the terms and conditions specified in section 1.7.

3. All policies shall be subject to approval by OUC, and issued by companies authorized by the State of Florida’s Department of Insurance to conduct business in the State of Florida.

4. The selected Bidder agrees that it and its subcontractors have a Drug-Free Workplace Program that complies with Florida Statute §§ 287.087 and 440.101 et. seq., the Omnibus Employee Testing Act of 1991, 49 Code of Federal Regulation § 391 and 40 (operation of commercial motor vehicles).

a. In addition, all subcontractors must implement a controlled substance and alcohol testing policy for safety sensitive positions as defined by the Commission’s Alcohol and Controlled Substance Testing Policy for Safety Sensitive Positions.

5. The selected Bidder’s employees and its subcontractors’ employees are further prohibited from being under the influence or impairment of alcohol on OUC property or work sites or at any time or place while conducting business with or on behalf of OUC.

6. The selected Bidder shall submit only one proposal/bid in response to this solicitation packet, and shall have no financial interest in other entities submitting proposals/bid responses for the same solicitation packet.

7. Neither the selected Bidder, nor its affiliates, nor anyone associated with them shall have any potential conflict of interest due to any other clients, contracts, business relationships or property interests for this solicitation packet’s scope of work.

8. The selected Bidder shall disclose to OUC the name(s) of any OUC employee, contractor, or OUC Board Member who has a direct or indirect financial interest in the selected Bidder’s organization, or in the proposed transaction. A direct or indirect financial interest in the selected Bidder’s organization, or in the proposed transaction exists if the OUC employee, contractor, or Board Member:

a. Presently, or in the preceding twelve (12) months, has an ownership interest in the selected Bidder’s organization (other than as owner of less than 1% of the stock of a publicly traded corporation).

b. Works for, is a partner, officer, director, trustee, or consultant to the selected Bidder.

c. Has received grant, travel, honoraria, or other similar support from the selected Bidder

d. Has a right to receive royalties from the selected Bidder.

9. No member of the selected Bidder’s ownership, management, or staff shall have a vested interest in any aspect of OUC, nor any business or other relationship with any of OUC’s employees, officers, directors, or Board Members that creates a conflict of interest or the appearance of a conflict of interest.

10. No member of the selected Bidder’s ownership or management is presently applying for an employee position or actively seeking an appointment within OUC.

11. The selected Bidder, or authorized signatory, shall provide written notice to OUC in the event that a conflict of interest is identified at any time.

3.3.1 Statement of No Bid

The OUC Procurement Department is committed to continuously improving its processes to receive maximum participation from the industry/market. OUC is requesting that organizations, who do not wish to bid on this RFP, send the Buyer of Record an email briefly explaining their “no bid” decision. This response will help to improve the solicitation process and any future communications.

3.4 GENERAL INFORMATION

Bidders shall prepare Proposals in accordance with the requirements of these Instructions to Bidders. Not preparing a Proposal, in accordance with such instructions, implies that the Bidder does not intend to comply with all of the proposed contract conditions. Such proposals will be considered irregular and may be rejected.

OUC will receive Proposals through the VendorLink system for goods, equipment, materials, and related services set forth in the included specifications and documents.

SCM-RFP-T-01 – Request for Proposal Template v5.0– 5/22/25 http://www.myvendorlink.com/

SCM-RFP-T-01 – Request for Proposal Template v5.0– 5/22/25

3.4.1 Common Terms

OUC and Bidders (the parties) agree that the following phrases each shall have the meaning provided here and may be used interchangeably:

1. “Bidder(s)”, “Supplier(s)”, and “Proposer(s)” shall mean the organization, party, person, firm, company, corporation, partnership, joint venture, or other type of entity responding to this solicitation.

2. “Solicitation” shall mean , “Request for Proposal(s)”, “RFP”, “Request for Quote”, “RFQ”, “Invitation to Bid”, “ITB”, “Solicitation Package” or, “Solicitation Packet”, to which the Bidder is responding.

3. “Bid(s)”, “Proposal(s)”, or “Quote(s)” shall mean the documents formally submitted to OUC by each of the Bidders responding to this solicitation packet.

3.4.2 Submittal

Bidders shall submit Proposals in accordance with the instructions and schedule included in the solicitation containing these specifications and documents. Refer to Section 4: Proposal Submittal Format & Checklist and submit Proposal with all applicable content.

3.4.2.1 Alternate Proposals

If the Bidder submits an alternate proposal, they shall identify clearly the proposal as an “Alternate Proposal”. OUC may consider alternate proposals a blanket exception to the solicitation and reject the Proposal.

3.4.3 Signatures

An authorized representative of each Bidder shall:

1. Sign or e-sign the Proposal, give their full name and title, and provide the Bidder’s business name and address.

2. Enter the organization’s exact legal name on the Proposal.

3. Sign or e-sign compliance forms, if applicable.

3.4.4 Withdrawal

Bidders may withdraw, alter, and resubmit their Proposals through VendorLink at any time prior to the Proposal due date and time. Proposals may not be withdrawn, altered, or resubmitted after the Proposal due date and time. OUC may request clarifications and additional information after proposal submission.

3.5 ELECTRONIC SUBMITTAL OF THE PROPOSAL

To ensure correct Proposal formatting, Bidders shall:

1. Submit Proposals electronically through VendorLink.

2. Upload files only in MS Word (.doc or .docx), Excel (.xls or .xlsx), and PowerPoint (.ppt or .pptx); Adobe Portable Document Format (.pdf); Compressed File (ZIP) formats.

3. Enable printing on files submitted.

4. Clearly identify the RFP Number, Name, Submission Date, and Bidder Name on the Response Cover Page on Bidder’s letterhead.

SCM-RFP-T-01 – Request for Proposal Template v5.0– 5/22/25

5. Separate and identify each part of the submission (i.e. document type, form type, content type) with a divider/separation page.

6. Contact VendorLink technical support at support@evendorlink.com, if technical difficulties arise during proposal submission.

7. Follow all instructions outlined in this RFP and provide all requested information.

OUC may ask the selected Bidder to supply one hard copy set with original, written signatures and original compliance forms, prior to the contract execution. Do not submit following both methods unless otherwise instructed.

3.6 COMPLIANCE FORMS

3.6.1 Public Entity Crimes

Each Bidder shall submit copies of an executed and notarized Sworn Statement under Section

287.133 (3)(a) and 287.135, Florida Statutes, on Public Entity Crimes and Scrutinized Companies.

3.6.2 Dispute Disclosure

Each Bidder shall submit copies of an executed Dispute Disclosure form.

3.7 RESERVED

3.8 PROPOSAL PREPARATION COSTS

OUC shall provide, without charge, one set of the specifications and documents to prospective Bidders for preparation of proposals. Addenda documents will be issued only to prospective Bidders registered in VendorLink.

This solicitation does not commit OUC to pay any costs incurred in the preparation and submission of the Proposal or to pay any other costs incurred prior to award.

3.9 EXCEPTIONS

OUC is seeking proposals that meet all technical and commercial requirements as outlined in this solicitation. If a Bidder takes exception to any solicitation requirement or condition, the exception must be specifically stated on the Exception Form provided within the solicitation document. OUC shall consider only those exceptions written on the form at the time the Proposal is submitted. The Bidder acknowledges that any exception taken to the solicitation criteria (including submitting an alternate proposal) may result in OUC determining the Proposal to be nonresponsive.

3.10 CLARIFICATIONS

If a prospective Bidder has doubt as to the true meaning of any part of the solicitation, they may submit a written request for clarification through email to the Buyer of Record; verbal requests will not be accepted. The Bidder must reference the Solicitation Package page number and section heading on any clarification requests

Failure of the Bidder to request information or make inquiries will not relieve them of any responsibility to perform under the terms of any contract awarded for the work in accordance with subsequent clarifications.

OUC shall issue an addendum to all Bidders, via VendorLink, once an inquiry is clarified and/or answered. Verbal responses will not be provided and are not binding on OUC.

mailto:support@evendorlink.com https://www.ouc.com/wp-content/uploads/2025/08/2025_08-Procurement-Public-Entitiy-Crimes-Form.pdf https://www.ouc.com/wp-content/uploads/2025/08/2025_08-Procurement-Public-Entitiy-Crimes-Form.pdf https://www.ouc.com/wp-content/uploads/2025/08/2025_08-ProcurementDispute-Disclosure-Form.pdf http://www.myvendorlink.com/ https://www.ouc.com/wp-content/uploads/2025/11/2025_11-Exceptions-for-Solicitation.pdf

SCM-RFP-T-01 – Request for Proposal Template v5.0– 5/22/25

3.11 LOCAL CONDITIONS

Each Bidder shall have thorough knowledge of conditions, factors, and scope of work, which would affect the execution and completion of the requested work. If required, site visits will be held the day of the Pre-Response Conference unless otherwise arranged.

Bidders shall investigate properly and consider all such factors in the preparation of every Proposal submitted. OUC shall not permit claims for financial adjustment based on the lack of prior information or its effect on the cost of the work.

3.12 OPENING

OUC shall open Proposals on the RFP Due Date at 2:30 p.m. EST at 100 West Anderson Street, Orlando, Florida. If required, at a public opening, OUC shall read only the Bidder name and if they have provided all the required information. OUC shall not share any other information at this time, with the exception of solicitations for construction or repairs on public works projects in which the price is submitted. Proposals not meeting the requirements may be rejected.

All questions concerning this solicitation must reference the document page number, and section heading. OUC shall answer questions and post them to VendorLink as an addenda to the solicitation.

3.13 SOLICITATION SELECTION SCHEDULE

OUC shall adhere to the stated schedule during the solicitation process, unless a change notice is issued to the Bidders via a written addendum. OUC reserves the right to postpone the date and time announced for the opening of proposals at any time.

OUC expects Proposals to address all of the information requested in the solicitation and subsequent clarifications, and to reflect the capabilities of the Bidder.

Bidders shall submit any supplemental information, and list any variations on the Exceptions form, in accordance with Section 4, Proposal Submittal Format & Checklist.

3.14 PROPOSAL ACCEPTANCE AND REJECTION

OUC reserves the right to accept the Proposal which, in its judgment, is the most responsive and responsible Proposal and to reject any and all proposals; as well as waive irregularities and formalities in any proposal that is submitted.

Without limiting the generality of the foregoing, OUC may reject any proposals which are incomplete or irregular; Proposals which omit any one or more items for which the solicitation requires, any Proposals which omit unit prices if unit prices are required, any Proposals from Bidders who have previously failed to satisfactorily complete contractual obligations.

1. The following shall cause an automatic rejection of the proposal:

a. Proposals delivered/submitted after the 2:00 p.m. due date

b. Failure to submit a Bid Bond (if required)

c. Failure to attend a mandatory Pre-Response Conference and/or any mandatory presentation (if required)

d. Failure to submit a signed Payment and Performance Bond Compliance Form when (a) a Payment and Performance Bond is required or (b) alternate payment and performance security permissible under Section 255.05, Florida Statutes is required https://www.ouc.com/wp-content/uploads/2025/11/2025_11-FL-Statutes-on-Payment-and-Performance-Bond.pdf

SCM-RFP-T-01 – Request for Proposal Template v5.0– 5/22/25

2. The following items may cause a rejection of the proposal:

a. Failure to submit copies of any of the signed & notarized (where required) forms:

i. Statement on Public Entity Crimes form

ii. Dispute Disclosure

3.15 PROPOSAL EVALUATION CRITERIA

OUC shall evaluate the Proposals based on the information provided by each of the Bidders. OUC’s review may include, but may not be limited to the following categories:

1. Qualifications and Experience, including past performance for OUC

2. Responsiveness to Requirements

3. Safety and Quality Programs

4. Financial Soundness of Organization

5. Price

OUC reserves the right to negotiate with Bidders who submitted responsive and responsible Proposals in the best interest of the OUC Commission. This negotiation process may occur prior to OUC Commission approval. Each Bidder acknowledges that OUC shall evaluate all Proposals and may initiate clarification discussions or seek additional information from all or some of the Bidders to fully understand any unclear elements of their proposals. Following clarification, OUC may initiate negotiations with the Bidder considered to be the most responsive and responsible. If no agreement is reached with the highest ranked Bidder, OUC may reject all Proposals or continue negotiations with each subsequently ranked Bidder until an acceptable deal is reached. A final contract award may be contingent upon OUC Commission and legal approval.

OUC reserves the right to consider historic information and facts, whether gained from the Bidder’s Proposal, question and answer conferences, references, and/or other sources during the evaluation process. OUC may conduct such investigations to assist with the evaluation of any Proposal. The investigation also serves to establish the Bidders’, subcontractors’, and other related entities’ responsibility, qualifications, and financial ability to fulfill the Proposal requirements to the Commission’s satisfaction, within the prescribed time.

The Bidder solely is responsible to submit information related to the evaluation categories. OUC is under no obligation to solicit such information. Failure of the Bidder to submit information may cause an adverse impact on the Proposal’s evaluation.

3.16 CANCELATION

Prior to the final execution of a Contract or full Notice to Proceed, OUC reserves the right to rescind said award without prior notice to Bidders. In addition, OUC may reject all Proposals, reissue the solicitation packet, or re-award the contract.

3.17 FREIGHT (IF APPLICABLE)

The selected Bidder shall coordinate with OUC’s freight contractor for shipping unless OUC determines that the selected Bidder can obtain freight/shipping rates or methods that are more advantageous to OUC. The selected Bidder shall submit an alternate shipping proposal based on delivery to OUC’s Free On Board (FOB) carrier at the designated OUC facility or location. The alternate proposal must include the:

https://www.ouc.com/wp-content/uploads/2025/08/2025_08-Procurement-Public-Entitiy-Crimes-Form.pdf https://www.ouc.com/wp-content/uploads/2025/08/2025_08-ProcurementDispute-Disclosure-Form.pdf

SCM-RFP-T-01 – Request for Proposal Template v5.0– 5/22/25

1. Carrier name

2. Insurance coverage

3. Firm price freight quote

The Bidder must include any alternate proposal in the bid response to this solicitation. OUC may accept or reject the proposed alternate shipping arrangement.

OUC’s freight/shipping supplier and contact information is:

Nexterus

1-888-867-5952 (Monday – Friday, 8:00 a.m. – 7:00 p.m. EST) dcs@nexterus.com

3.18 BID BOND (IF APPLICABLE)

Bidder may be required to submit a certified check or cashier’s check drawn on an acceptable bank, or an acceptable Bidder’s bond executed by the Bidder and a surety company authorized to do business in the State of Florida. The value of the bid bond shall be five percent (5%) of the proposal price schedule. When submitting a Proposal through VendorLink, the Bidder shall provide a copy of the check and express mail the original check to the delivery location provided on the first page of the Solicitation Packet Form.

The bid bond guarantee shall be made payable without condition to OUC. The amount of the check or bond may be retained by and forfeited to OUC as liquidated damages if the Proposal results in a contract award and the Bidder fails to honor the accepted terms.

OUC shall return the selected Bidder’s bid bond when that Bidder executes the contract and files a satisfactory payment and/or performance bond, if required. OUC may retain the bid bond of the second highest ranked Bidder for a period not to exceed thirty (30) days, pending the execution of the contract by the selected Bidder. OUC shall return the bid bond of each unsuccessful Bidder upon request, after the contract is awarded or when the Proposal is rejected.

3.19 PAYMENT AND PERFORMANCE BOND (IF APPLICABLE)

The selected Bidder may be required to furnish a Payment and Performance Bond to OUC per Florida Statutes; Section 255.05 equal to 100 percent of the contract price. The cost of such bonds shall be stated as a separate line item in the Proposal.

A surety company, authorized to do business in the State of Florida and acceptable to OUC, shall sign the bond. The Performance Bond and Payment Bond shall be dated with the actual execution date. With these bonds, the responsible party shall file certified copies of the power of attorney of such attorney-in-fact signing the bond on behalf of the surety, and such certificates shall be certified to show that such power of attorney was in effect to and including the date of the actual execution of the bonds. Any bonds submitted by a surety or its agent shall be conclusively presumed to have been authorized by and binding upon the surety company irrespective of the date shown on the power of attorney.

If bonds are required, they shall remain in full force and effect until satisfactory completion of any specified performance guarantee tests, or satisfactory completion of all other contractual requirements, whichever shall occur last. Upon recording of the performance and payment bond (if applicable) Bidder shall provide OUC three (3) copies.

https://www.ouc.com/wp-content/uploads/2025/11/2025_11-FL-Statutes-on-Payment-and-Performance-Bond.pdf

SCM-RFP-T-01 – Request for Proposal Template v5.0– 5/22/25

OUC shall furnish a copy of the selected Bidder’s bond to any lienor demanding that bond under the provisions of Florida Statute 713.23.

3.20 CONTRACT EXECUTION

The selected Bidder shall execute the necessary contractual forms, and return the executed forms within ten (10) business days of receipt of forms for execution.

3.21 AWARD

OUC reserves the right to award a single or multiple contracts for all proposal items, or to award separate contracts for single proposal items or any combination of such items; or to make no contract award.

OUC shall be the sole judge of its own best interests, the proposals, and the resulting contract. An award may be made to the most responsive and responsible organization whose proposal is determined to be the most advantageous to OUC. The Commission’s decision shall be final and OUC’s rights include the ability to:

1. Reject any or all proposals or parts thereof

2. Issue subsequent solicitations

3. Cancel the entire solicitation

4. Remedy technical errors on the solicitation

5. Negotiate with any, all or none of the Bidders

6. Award a contract to one or more Bidders or none at all

7. Accept other than the lowest price

8. Waive informalities and irregularities in proposals

3.22 TAXES, PERMITS, AND LICENSES

The Bidder's attention is directed to the General Terms and Conditions and the Florida Statutes regarding taxes, permits, and licenses. It shall be the Bidder's responsibility to determine the applicable taxes, permits, and licenses. If the Bidder has doubt as to whether or not a tax, permit, or license is applicable, they shall state in their proposal whether this item has been included in their proposal price and the amount of the applicable tax, permit, or license in question.

3.23 ERROR AND OMISSIONS

Bidders or their authorized representatives are expected to be fully informed as to the conditions, requirements and specifications before submitting proposals; failure to do so will be at the Bidder’s own risk. Neither law nor regulations make allowance for errors either of omission or commission on the part of Bidders. In case of error of extension of prices in the proposal, the unit price shall govern.

3.24 PROPOSAL SUBMITTAL FORMAT

Bidders shall complete all required forms, and include them in the proposal submittal package with any other required information. Refer to Section 4, Proposal Submittal Format & Checklist for more information.

SCM-RFP-T-01 – Request for Proposal Template v5.0– 5/22/25

3.24.1 OUC Policies and Procedures for Bidders

The Bidder shall read and comply with OUC’s policies and procedures before submitting this Proposal:

1. Contractor Security Policy

2. Bid Protest Guidance

3. Generic Contractor Orientation

4. Drug and Alcohol-Free Workplace and Testing Policy

5. OUC Travel and Expense Guidelines

6. All policies – OUC Procurement Services Department website

These policies and any supplemental policies provided at contractor orientation are hereby fully incorporated into this contract by reference and to the extent applicable to the supplier in the performance of their work. Supplier and its subcontractors, suppliers, agents, and employees shall fully comply with all such policies as amended from time to time.

3.25 SIGNATURES

By submitting this proposal with the authorized electronic signature, the Bidder hereby declares that, in all respects for and in good faith, without collusion or fraud:

1. Only the individuals or organizations interested in this proposal/bid response as principal or principals are named in this Proposal.

2. No other individuals or organizations than mentioned in this Proposal have any interest in this Proposal/Bid Response or in the subsequent contract.

3. This Proposal/Bid Response is made without connection with any other person, company, or parties likewise submitting a Proposal/Bid Response.

Bidders shall prepare Proposals in accordance with the Instructions to Bidder’s document. Failure to submit the necessary forms may cause a rejection of the proposal. The Bidder hereby agrees to provide the services and/or items specified in the solicitation packet at the prices quoted pursuant to the requirements of this document.

https://www.ouc.com/wp-content/uploads/2024/12/Procurement_procure_contractor_sec_pol.pdf https://www.ouc.com/wp-content/uploads/2024/12/Procurement_bid_protest.pdf https://www.ouc.com/wp-content/uploads/2024/12/Procurement_procure_contractor_orientation_stanton.pdf https://www.ouc.com/wp-content/uploads/2024/12/Procurement_proc_alc_cont_subs_testing_pol.pdf https://www.ouc.com/wp-content/uploads/2024/12/Procurement_supplier_business_expense_guidelines.pdf https://www.ouc.com/doing-business-with-ouc/

SCM-RFP-T-01 – Request for Proposal Template v4.2– 10/21/19

4 PROPOSAL SUBMITTAL FORMAT & CHECKLIST

A checkmark (✓) on the items below indicates these are applicable items and the terms and conditions stated in earlier sections are applicable. Bidders shall complete all the forms checked (✓) below, and include them in the proposal submittal package in order with any other information.

Provide a written signature on all original forms and, when required, a notary stamp. Scan & upload these forms with the Proposal.

Technical Response File (checked if applicable)

Tab 1 – Cover Page

Proposal Cover Page on Bidders Letterhead

Bidder Information as listed in Section 2.2.1

Tab 2 – Bidder Background and Qualifications

References and Qualifications as listed in Section 2.2

Tab 3 – Response to Requirements

Response to all Requirements as listed in Section 2 and any applicable Attachments

Tab 4 – Compliance Forms

Submit at time of proposal

Exceptions

Sworn Statement on Public Entity Crimes and Scrutinized Companies Under Florida Statutes, Section 287.133 (3) (a) and 287.135

Dispute Disclosure

☐ Bid Bond as described in Section 3.18 (If Applicable)

Addenda (If Applicable)

Provided at time of award

Copy of Company’s Business License

Copy of Insurance Certificate

W-9 Form

☐ Payment & Performance Bond as described in Section 3.18 (If Applicable) https://www.ouc.com/wp-content/uploads/2025/11/2025_11-Exceptions-for-Solicitation.pdf https://www.ouc.com/wp-content/uploads/2025/08/2025_08-Procurement-Public-Entitiy-Crimes-Form.pdf https://www.ouc.com/wp-content/uploads/2025/08/2025_08-Procurement-Public-Entitiy-Crimes-Form.pdf https://www.ouc.com/wp-content/uploads/2025/08/2025_08-ProcurementDispute-Disclosure-Form.pdf https://www.ouc.com/wp-content/uploads/2025/11/Addendum.pdf https://www.ouc.com/wp-content/uploads/2025/11/w9.pdf https://www.ouc.com/wp-content/uploads/2025/11/2025_11-FL-Statutes-on-Payment-and-Performance-Bond.pdf

SCM-RFP-T-01 – Request for Proposal Template v5.0 - 5/22/25

5 ATTACHMENTS

Attachment A:

Attachment B:

Attachment C:

Exhibit 1:

Exhibit 2:

Exhibit 3:

Detailed Scope of Work & Requirements

Price Schedule

Invitation to Pre-Response Conference D

Terms and Conditions for Cloud Hosted Solutions

Sample – OUC Software License Terms and Conditions

General Terms and Conditions for Goods and Services

SCM-RFP-T-01 – Request for Proposal Template v5.0 - 5/22/25

DETAILED SCOPE OF WORK & REQUIREMENTS

1 Purpose and Scope

The selected vendor shall provide and implement an enterprise-grade Cybersecurity Governance, Risk, and Compliance Solution that supports OUC’s enterprise risk management, third-party risk management, compliance, and governance processes across electric and water utility operations.

2 Functional and Non-Functional Requirements

Proposed solutions should meet specific functional capabilities and/or features as described in the following table and vendors should describe their ability to meet requirements in their response.

Capability / Feature Requirements

Enterprise Risk Management

• Provide a centralized system of record for enterprise risks across IT and business processes.

• Support the full risk lifecycle: Allow assignment of risk ownership, track inherent and residual risk, and maintain historical records for audit and reporting purposes.

Risk Assessment

• Support standardized and repeatable risk assessment processes, including preliminary risk assessments, threat-based risk assessments, and criticality or impact assessments.

• Support configurable scoring methodologies and automated documentation of assessment results.

Risk Treatment & Remediation

• Support documentation and tracking of risk treatment decisions, assignment of remediation actions, tracking of progress and validation of closure, and maintenance of audit-ready records of approvals and outcomes.

Enterprise Risk Register

• Maintain a centralized enterprise risk register that associates risks with assessments, assets, controls, remediation actions, and third parties, and supports filtering, reporting, and aggregation for management oversight.

Third Party Risk Management

• Support identification, classification, and tiering of third parties;

execution of third-party risk assessments during procurement and ongoing vendor management; centralized tracking of third-

SCM-RFP-T-01 – Request for Proposal Template v5.0 - 5/22/25 party risks and remediation; and correlation of third-party risks with enterprise risks.

External Vendor Risk Intelligence Integration

• Support integration with external third-party risk intelligence and monitoring tools, ingestion and tracking of vendor risk indicators, and correlation of external intelligence with internal risk assessments.

• Offer integrations with external third-party risk intelligence platforms (please specify if this functionality is provided through native, pre-built connectors or require custom integration using application programming interfaces (APIs).

Integration

• Integration support (native connector, configurable connector, or custom API integration) for commonly used third-party risk intelligence platforms, such as security rating and monitoring platforms used for third-party risk management and external vendor cyber risk scoring and monitoring services. Please provide specifics.

Governance, Workflow, and

Approvals

• Provide configurable workflows for reviews, approvals, escalations, and risk acceptance; support governance and committee oversight; enforce role-based access controls; and maintain records of decisions and exceptions.

Audit, Compliance, and Evidence Management

• Supports audit readiness through centralized documentation and evidence retention, tracking of audit findings and remediation, and traceability between risks, controls, assessments, and remediation activities.

Reporting and Dashboards

• Provides configurable dashboards and reporting for executive, management, and operational users, support drill-down into detailed records, and enable scheduled and ad hoc reporting.

Usability and Ease of Use

• Provides an intuitive and user-friendly interface that supports efficient use by both frequent and occasional users.

• Requires minimal training for business users performing infrequent or low-complexity tasks, such as risk owners completing attestations, providing updates, or reviewing assigned remediation actions.

• Supports role-appropriate user experiences that reduce administrative burden and promote adoption across business, technology, and governance stakeholders.

SCM-RFP-T-01 – Request for Proposal Template v5.0 - 5/22/25

Scalability and Extensibility

• Solution is scalable and configurable to support future expansion of risk, compliance, and governance use cases without requiring replacement of the core platform.

Content Libraries and Framework Support

• Provides out-of-the-box content libraries that support commonly adopted regulatory, cybersecurity, and risk management frameworks relevant to OUC’s operating environment. (Note:

Please identify which content libraries are included as part of the base solution and which content libraries require additional licensing or subscription fees.)

• Supports configurable or pre-built content aligned to commonly used frameworks (NIST, ISO)

• Allows OUC to map risks, controls, assessments, and evidence to supported frameworks and to manage multiple frameworks concurrently.

Security

• Comply with the current National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) standards.

• Provides role-based access control (RBAC) to restrict who within the organization can access services, ensuring compliance with privacy regulations.

• Meets requirements defined in Security Exhibits

SCM-RFP-T-01 – Request for Proposal Template v5.0 - 5/22/25

PRICE SCHEDULE

To evaluate pricing, please provide pricing in the following format (add lines as necessary for any options) – Excel spreadsheet also provided:

Item Qty Unit Cost Extended Cost

Discount Percentage*: 0% -$

Discount Percentage*: 0% -$

Signature Date

Company Name

Other Fees (add lines for different options)

Total Years 1 - 2

Total Years 4 - 5

Subtotal Years 4-5

Total Contract Value:

Description

Year 1: Software / Subscription (indicate license count if applicable)

Implementation Fee (one-time cost) Training (indicate type – Admin, User, Train the Trainer)

Year 2: Software / Subscription (indicate license count if applicable) Year 3: Software / Subscription (indicate license count if applicable)

Content Library or Other Cost Integration (add lines for different options or per API)

Subtotal Years 1 - 3

Year 4: Software / Subscription (indicate license count if applicable) Year 5: Software / Subscription (indicate license count if applicable)

Comments (Please describe any discount or other conditions):

SCM-RFP-T-01 – Request for Proposal Template v5.0 - 5/22/25

INVITATION TO PRE-RESPONSE CONFERENCE

[Complete Invitation to Pre-Response Conference information below. If not applicable, delete content and mark “N/A.”]

Date: August 4, 2026 Time: 9:00 AM Eastern Standard Time (EST)

Location:

(Address/floor/room)

Microsoft Teams

Conference Number: +1 312-319-1619,,399341447#

Video Conferencing: https://teams.microsoft.com/meet/281202120798970?p=NOZKfJpuNSFIPjyw

Attendance is: Mandatory Not Mandatory ☐

RSVP: Please RSVP via email to the Buyer of Record at least 48 hours in advance of the meeting, and bring the RFP containing the specifications and government issued photo identification when you attend. Also, please email any questions two days prior to the meeting.

Questions/Directions:

Objective:

Agenda:

If you have any questions about the Pre-Response Conference, please contact:

Al Segura 407-434-2974 asegura@ouc.com

Will discuss important information regarding RFP process, receive feedback and questions from suppliers, and provide any additional information or clarifications to suppliers.

Introductions – 10 Mins Q & A – 20 Mins tel:+13123191619,,399341447 https://teams.microsoft.com/meet/281202120798970?p=NOZKfJpuNSFIPjyw33 https://teams.microsoft.com/meet/281202120798970?p=NOZKfJpuNSFIPjyw33

3.25 Signatures