RFP026-50 Cybersecurity Services.pdf

For more information, please visit our online supplier portal, located at https://procurement.opengov.com/portal/meridenct

City of Meriden

Purchasing Department

142 East Main St. Room 210

Meriden, CT 06450

RFP026-50 CYBERSECURITY SERVICES

Project ID: RFP026-50

RELEASE DATE: March 17, 2026

RESPONSE DEADLINE: April 1, 2026, 11:00 am

Please refer to the project timeline in this document for all important deadlines.

Request For Proposal #RFP026-50

Title: RFP026-50 Cybersecurity Services

Table Of Contents

1. LEGAL NOTICE

2. INFORMATION TO PROPOSERS

3. SCOPE OF SERVICES

4. EVALUATIONS/QUALIFICATIONS

5. VENDOR SUBMISSION FORMS

Attachments:

AA - Professional Services- Sample Agreement

LEGAL NOTICE

REQUEST FOR PROPOSALS

The City of Meriden is accepting electronic proposals for:

RFP026-50 Cybersecurity Services

The City of Meriden is seeking a vendor capable of providing advanced cybersecurity monitoring and response capabilities aligned with industry best practices.

Proposals shall be submitted as electronic responses per specifications obtained via the City eProcurement Portal: https://procurement.opengov.com/portal/meridenct and on the State of Connecticut

Department of Administrative Services website (https://webprocure.proactiscloud.com).

Proposals may be received up to but not later than 11:00 am, Wednesday, April 1, 2026 via the City eProcurement Portal located at https://procurement.opengov.com/portal/meridenct. The City eProcurement

Portal Clock is the official clock for the determination of all deadline dates and times. Without exception, responses will not be accepted after the submission deadline regardless of any technical difficulties. Please submit electronic responses via the City eProcurement

Portal: https://procurement.opengov.com/portal/meridenct by way of the eProcurement Portal, responses will be locked and digitally encrypted until the submission deadline passes.

The right is reserved to reject any or all proposals, in whole or in part, to award any item, group of items, or total proposal, and to waive informality or technical defects, if it is deemed to be in the best interest of the City of Meriden. No proposer may withdraw its proposal within ninety (90) days of the date of the opening.

The City reserves the right to reject any or all proposals and may waive any informality.

The City of Meriden is an Affirmative Action/Equal Opportunity Employer. Disadvantaged, minority, small, and women business enterprises are encouraged to respond.

Rawle Dummett Purchasing Officer City of Meriden, CT 06450-8022 Dated: March 17, 2026 https://procurement.opengov.com/po1tal/meridenct https://webprocure.proactiscloud.com/

INFORMATION TO PROPOSERS

1. SUMMARY & OBJECTIVES

The City of Meriden is seeking proposals from qualified cybersecurity service providers to deliver Security

Operations Center (SOC) monitoring and cybersecurity support services for the City’s information technology infrastructure.

The selected vendor will provide continuous monitoring, threat detection, incident response assistance, and cybersecurity advisory services to help the City maintain a strong security posture across its technology environment.

The objectives of this RFP are to:

• Implement 24/7 security monitoring

• Detect potential cybersecurity threats

• Provide timely incident response guidance

• Improve visibility into security events

• Strengthen the City’s cybersecurity posture

• Provide cybersecurity expertise and recommendations

2. BACKGROUND

The City of Meriden maintains a variety of information systems that support municipal services, public safety operations, and administrative functions.

The City is seeking to enhance its cybersecurity capabilities through the engagement of a qualified vendor that can provide Security Operations Center monitoring and cybersecurity expertise to supplement internal IT resources.

The City’s IT environment includes a combination of:

• On-premise infrastructure

• Virtual server environments

• Endpoint devices

• Network infrastructure

• Identity management services

• Cloud-based services

The City seeks a vendor capable of providing advanced cybersecurity monitoring and response capabilities aligned with industry best practices.

3. TIMELINE

Release Project Date: March 17, 2026

Question Submission Deadline: March 25, 2026, 4:00pm

Response Submission Deadline: April 1, 2026, 11:00am

4. PROPOSAL PROCEDURES

The City will only be accepting electronic submissions of proposals. Please submit electronic responses via the

City eProcurement Portal: https://procurement.opengov.com/portal/meridenct. By way of the eProcurement

Portal, responses will be locked and digitally encrypted until the submission deadline passes. Proposals are due for submission no later than 11:00 am, Wednesday, April 1, 2026.

5. PROPOSALS/QUALIFICATIONS

A. Proposals shall be submitted in two sealed parts: Qualifications; Part A and Proposal Fees; Part B.

B. Proposals must be made out and signed in the corporate, or other, name of Proposer, and must be fully and properly executed by an authorized person.

C. Proposals received later than the time and date specified will not be considered.

D. Amendments to or withdrawal of Proposals received later than the date and time set forth in the proposal opening will not be considered.

6. EXAMINATION OF DOCUMENTS

Proposers are to examine all documents and visit the site in order to make a thorough examination of the conditions so that they may familiarize itself with all of the existing requirements, conditions, and difficulties that will affect the execution of the work in order to determine the amount of work necessary to carry out the true intent of the specifications and work shown on the drawings.

The City of Meriden and its agents do not have any responsibility for the accuracy, completeness, or sufficiency of any proposal document obtained from any other source other than from the City eProcurement Portal:

https://procurement.opengov.com/portal/meridenct. Obtaining documents from any other source(s) may result in obtaining incomplete and inaccurate information. Obtaining documents from any other source may also result in failure to receive any addenda, corrections, or other revisions to the documents that may be issued.

No request shall be honored if such request is made less than seven (7) calendar days prior to the date fixed for the opening of proposals. Any and all such interpretations, and any supplementary instructions, will be in the form of a written addenda to the specifications which, if issued, will be made available via the City eProcurement Portal, located at https://procurement.opengov.com/portal/meridenct for addenda. Failure of any proposals to receive any such addenda shall not relieve any proposals from any obligations under its proposal as submitted.

Proposers shall submit all inquiries regarding this proposal via the City eProcurement Portal, located at https://procurement.opengov.com/portal/meridenct. Please note the deadline for submitting inquiries. All answers to inquiries will be posted on the City eProcurement Portal. Proposers may also click “Follow” on this document to receive an email notification when answers are posted. It is the responsibility of the proposer to check the website for answers to inquiries.

7. AWARD OF CONTRACT

The Purchasing Officer reserves the right to reject any or all proposals or parts thereof for any reason, to negotiate changes to proposal terms and to waive minor inconsistencies with the RFP. The Purchasing Officer reserves the right to make a selection on the basis of qualifications, experience in providing similar services elsewhere, the proposal’s responsiveness to the Request For Proposal requirements; and to negotiate a contract with the Consultant(s).

The contract will not be awarded to any corporation, firm, or individual which/who is in arrears to the City of

Meriden by debt or contract, or who is in default as security or otherwise by any obligation to the City of

Meriden.

The right is reserved to reject any or all proposals, in whole or in part, to award any item, group of items, or total proposal, and to waive informality or technical defects, if it is deemed to be in the best interest of the City of Meriden.

8. TAXES

The City of Meriden is exempt under Connecticut General Statutes from the payment of the excise taxes imposed by the federal government and the Sales and Use Tax of the State of Connecticut; such taxes should not be included in the proposal price. Upon request, exemption certificates will be furnished to the successful

Proposer.

9. FAIR EMPLOYMENT PRACTICES

The Contractor shall agree that neither it or its subcontractors, except in the case of a bona fide occupational qualification or need, to refuse to hire or employ or to bar or to discharge from employment any individual or to discriminate against such individual in compensation or in terms, conditions or privileges of employment because of the individual's race, color, religious creed, age, sex, gender identity or expression, marital status, national origin, ancestry, present or past history of mental disability, intellectual disability, learning disability, physical disability, including, but not limited to, blindness or status as a veteran. The aforementioned terms are obtained from Connecticut General Statutes Section 46a-60, et seq., entitled “Discriminatory employment practices prohibited,” as amended.

10. NON-COLLUSION STATEMENT

Each proposer submitting a proposal to the City of Meriden for any portion of the work contemplated by the documents on which bidding is based shall execute and attach thereto the sworn Non-Collusive Statement, to the effect that the proposal has not colluded with any other person, firm, or corporation in the submission of the proposal/qualifications.

11. FORM OF AGREEMENT BETWEEN CITY OF MERIDEN AND CONSULTANT

The Agreement for the work will be via Purchase Order and NO VALUE.

12. CITY OF MERIDEN CODE OF ETHICS

The City of Meriden has adopted a Code of Ethics located in Chapter 21 of the Code of the City of Meriden, sections 21-1 through 21-15, inclusive, which are expressly incorporated herein by reference. The terms of the

Code of Ethics shall constitute a part of any contract or agreement entered into by the City of Meriden as a result of this proposal as if those terms were fully set forth in such contract or agreement.

Proposers are specifically advised that the Code of Ethics prohibits public officers and employees, as well as their immediate families and businesses, with which they are associated from participating in any transaction which is incompatible with the proper discharge of official duties or responsibilities. Proposers are also advised that the Code of Ethics contain provisions with respect to paid contractors and former employees and officials.

PROPOSERS SHOULD NOTE THAT PROPOSALS, CONTRACTS, AND AGREEMENTS ENTERED

INTO OR AWARDED IN VIOLATION OF THE CODE OF ETHICS ARE VOIDABLE BY

RESOLUTION OF THE CITY COUNCIL OF THE CITY OF MERIDEN.

Copies of the Code of Ethics may be obtained from the office of the City Clerk or may be found online on the

City of Meriden’s website.

13. ASSIGNMENT OF CONTRACT

No contract may be assigned without the written consent of the Purchasing Officer or designee.

14. PERMITS

The Contractor shall be responsible for obtaining any and all necessary permits required by the City of Meriden prior to the commencement of work. The Contractor may contact the City of Meriden Building Department for permit information at (203) 630-4091. For all other required permits, contact the City of Meriden Engineering

Department at (203) 630-4018.

15. PRICE AND PAYMENT

The City of Meriden is exempt from the payment of the excise taxes imposed by the Federal government and the Sales and Use Tax of the State of Connecticut under Connecticut General Statutes; accordingly, such taxes shall not be included in the pricing.

The City of Meriden, unless stated otherwise in the documents or Contract, will make payment to the

Contractor not less than thirty (30) days following completion of services.

16. INSURANCE

The successful consultant shall be required to provide a Certificate of Insurance denoting general liability, automobile liability, workers compensation liability, and other coverage required by the City’s Risk Manager.

17. LICENSES AND CERTIFICATIONS

The successful firm(s) shall ensure that any appropriate licenses or certifications required by the State of

Connecticut are maintained for the duration of the project. The firm must meet all municipal, state and federal affirmative action and equal employment opportunity practices.

18. LENGTH OF CONTRACT

Thirty (30) days prior to the expiration of the resulting contract, the parties may, by mutual agreement, extend the contract for up to two (2) additional, three (3) year terms. Any extension must be in writing, executed by both parties.

19. TERMS AND CONDITIONS

The selected consultants must have the capability to provide the City of Meriden with expertise in performing other functions, such as, but not limited to, preparation of permit applications, liaison functions and clerical assistance. The following are some potential services which the selected Consultant may be required to provide.

It is also understood that the selected consultant will be required to complete all direct or indirect responsibilities associated with the assigned task so that the intent and desired goal of the City can be achieved.

These services may include, without limitation, reviewing drawings and specifications, providing individuals or sub-consultants with specialized knowledge, assisting in the preparation of legal proceedings, appearance before

Courts or Commissions, providing expert opinions, or conclusions as well as performing investigations of technical matters.

SCOPE OF SERVICES

PROJECT INFORMATION

1. PROJECT DETAILS AND EXPECTATIONS

The selected vendor will provide cybersecurity monitoring and advisory services including, but not limited to, the following:

1. Security Operations Center Monitoring

Vendor shall provide:

• 24/7/365 monitoring of security events

• Log aggregation and analysis

• Security alert triage and investigation

• Threat detection and correlation

• Security event escalation

Monitoring may include:

• Servers

• Endpoints

• Network devices

• Identity systems

• Cloud services

• Firewalls

• VPN systems

2. Incident Response Support

Vendor shall provide support in the event of a cybersecurity incident including:

• Incident analysis and triage

• Investigation support

• Containment and remediation recommendations

• Forensic analysis assistance when required

• Incident reporting and documentation

3. Threat Intelligence

Vendor shall provide access to relevant cybersecurity threat intelligence including:

• Indicators of compromise (IOC)

• Emerging threat advisories

• Vulnerability alerts relevant to municipal environments

• Threat hunting capabilities where applicable

4. Security Monitoring Technology

Proposals should describe:

• Security monitoring tools used by the vendor

• Security Information and Event Management (SIEM) capabilities

• Endpoint detection and response capabilities

• Integration with existing City systems

5. Reporting and Communication

Vendor shall provide regular reporting including:

• Monthly security reports

• Incident reports

• Summary of alerts and responses

• Security posture recommendations

The vendor must also provide clear escalation procedures and communication protocols.

6. Cybersecurity Advisory Services

Vendor shall provide guidance and recommendations related to:

• Cybersecurity best practices

• Security architecture improvements

• Identity and access management

• Endpoint protection

• Backup and recovery strategies

• Security policy development

2. VENDOR QUALIFICATIONS

Respondents must demonstrate:

• Experience operating a 24/7 Security Operations Center

• Experience supporting government or municipal clients

• Demonstrated cybersecurity expertise

• Ability to support a mixed on-premise and cloud environment

Vendor personnel should hold relevant certifications such as:

• CISSP

• GIAC

• CISM

• Security+

Experience with industry security frameworks such as the following is preferred:

• NIST Cybersecurity Framework

• CIS Critical Security Controls

3. PROPOSAL REQUIREMENTS

Proposals must include the following sections.

Executive Summary

Overview of the vendor’s proposed solution.

Company Background

• Company history

• SOC locations

• Number of cybersecurity personnel

Technical Approach

Description of:

• Monitoring methodology

• Detection technologies

• Incident response procedures

Implementation Plan

Proposed onboarding timeline and deployment approach.

Staffing

Identification of key personnel and certifications.

Pricing

Detailed pricing including:

• Implementation

• Ongoing monitoring services -please provide 1, 3 & 5 year pricing plans.

• Optional services

References

Provide three references, preferably from government or public sector clients.

EVALUATIONS/QUALIFICATIONS

No. Evaluation Criteria Scoring Method Weight (Points)

1. Qualifications & Experience Points Based 30 (30% of Total)

2. Demonstrated ability of key personnel experience.

Points Based 20

(20% of Total)

3. References of past clients. Points Based 20 (20% of Total)

4. Detailed Pricing Points Based 30 (30% of Total)

VENDOR SUBMISSION FORMS

1. NON-COLLUSIVE STATEMENT/AFFIDAVIT*

Please download the below documents, complete, and upload.

• Non-Collusive_Bid_Statement...

*Response required

2. EXECUTIVE SUMMARY & IMPLEMENTATION PLAN*

Do NOT provide pricing information here!

*Response required

3. PRICING PROPOSAL*

*Response required

4. Additional Information https://government-project.s3.us-west-2.amazonaws.com/196784/702c7dfa-5aaa-4f75-8268-1eb67e4e69da_Non-Collusive_Bid_Statement.pdf