P-690 (04-26) Request for Proposal Page 1 of 4 Sourcing Event: 0000011913 9/3/2026

City and County of San Francisco

Formal Request for Proposals for:

Staffing Firms for

Cybersecurity IAM / PAM, and Active Directory Resources Sourcing Event ID: 0000011913

This Solicitation can be viewed on the City’s Supplier Portal at:

https://sfcitypartner.sfgov.org/pages/index.aspx

Proposal Phase Tentative Date

Request for Proposals Issued Tuesday, September 22, 2026 at 10:00 am PST

Pre-Proposal Conference Wednesday, September 30, 2026 at 11:00 am PST Microsoft Teams meeting Join:

https://teams.microsoft.com/meet/284941572221494?p=txpE0MDPo EMcOA7ltY Meeting ID: 284 941 572 221 494 Passcode: KQ9aY7sW

Need help? | System reference Dial in by phone +1 415-906-4659,,987874779# United States, San Francisco Find a local number Phone conference ID: 987 874 779# For organizers: Meeting options | Reset dial-in PIN

Written Questions Due Date Friday, October 9, 2026 by 10:00 am PST

Proposal Due Date Tuesday, October 20, 2026 by 3:00pm PST (uploaded to PeopleSoft and emailed to contract administrator)

Notice of Intent to Award Week of November 2nd, 2026

Period for Protesting Notice of Intent to Award

Within three (3) business days of the City's issuance of a Notice of Intent to Award.

Contract Administrator: Ken Edhammer Department of Technology Principal Contracts Analyst 1 South Van Ness Ave, 2nd Floor, SF, CA 94103 Phone: 628-652-5093 Email: Kenneth.edhammer@sf.gov https://sfcitypartner.sfgov.org/pages/index.aspx https://teams.microsoft.com/meet/284941572221494?p=txpE0MDPoEMcOA7ltY https://teams.microsoft.com/meet/284941572221494?p=txpE0MDPoEMcOA7ltY https://aka.ms/JoinTeamsMeeting?omkt=en-US https://teams.microsoft.com/l/meetup-join/19%3ameeting_OWNjNjI5MmEtZWM5Ny00MTdlLThlMzQtZTBmMTE5MmY2YWQ5%40thread.v2/0?context=%7b%22Tid%22%3a%2222d5c2cf-ce3e-443d-9a7f-dfcc0231f73f%22%2c%22Oid%22%3a%22b318b952-29c3-4a44-9079-d136878bdbea%22%7d tel:+14159064659,,987874779 https://dialin.teams.cloud.microsoft/6ab5bcf2-34a3-4844-8511-4e51fb43f358?id=987874779 https://teams.microsoft.com/meetingOptions/?organizerId=b318b952-29c3-4a44-9079-d136878bdbea&tenantId=22d5c2cf-ce3e-443d-9a7f-dfcc0231f73f&threadId=19_meeting_OWNjNjI5MmEtZWM5Ny00MTdlLThlMzQtZTBmMTE5MmY2YWQ5@thread.v2&messageId=0&language=en-US https://dialin.teams.cloud.microsoft/usp/pstnconferencing mailto:Kenneth.edhammer@sf.gov

P-690 (04-26) Request for Proposal Page 2 of 4 Sourcing Event: 0000011913

MANDATORY MINIMUM

QUALIFICATION

DOCUMENTATION

Proposers must submit the necessary documentation with their proposals to demonstrate they meet every Minimum Qualification (MQ) requirement set forth in Section 6 of this solicitation. A proposal that fails to provide the required documentation will not be eligible for further consideration.

ATTACHMENTS

Attachment 1: City’s Contract Terms Attachment 2: Proposer Questionnaire and References Attachment 3: CMD LBE Forms (Omitted) Attachment 4: Written Proposal Template (Omitted) Attachment 5: Price Proposal Template Attachment 6: HCAO and MCO Declaration Forms – Reserved for Contract Awardees Attachment 7: First Source Hiring Form – Reserved for Contract Awardees Attachment 8: Vendor Attestation of Digital Accessibility Compliance (Omitted) Attachment 9: WCAG Information Factsheet (Omitted)

P-690 (04-26) Request for Proposal Page 3 of 4 Sourcing Event: 0000011913

Table of Contents

1 RFP SUMMARY

1.1 Introduction

1.2 Selection Overview

1.3 Anticipated Contract Term

1.4 Anticipated Contract Not to Exceed Amount

1.5 Indefinite Quantity, As-Needed Contract

1.6 Cooperative Purchasing and Use by Other City Departments

1.7 Contract Terms and Negotiations

2 SOLICITATION SCHEDULE

3 REQUIREMENTS FOR REQUESTED GOODS AND SERVICES

3.1 Goods and/or Services Requested

3.2 Regulatory and Compliance Requirements Specific to the Goods/Services Solicited “Reserved”

3.3 Alternates and Samples – “Reserved”

3.4 Freight on Board and Shipping Costs – “Reserved”

3.5 Additional Purchases – “Reserved”

4 LOCAL BUSINESS ENTERPRISE (LBE) PROGRAM REQUIREMENTS

4.1 CMD Compliance Officer

4.2 Application of LBE Rating Bonuses

4.3 LBE Subcontracting Participation Requirements

4.4 CMD LBE Forms – “Reserved.”

4.5 LBE Payment and Utilization Tracking – “Reserved.”

5 PROPOSAL EVALUATION CRITERIA

6 MINIMUM QUALIFICATIONS AND DOCUMENTATION REQUIRED WITH

PROPOSAL (PASS/FAIL)

7 WRITTEN PROPOSAL (80 POINTS)

8 PRICE PROPOSAL (CHOOSE: 20 POINTS)

8.1 Price Proposal Format and Allocation of Points

8.2 Price Proposal Evaluation Period

8.3 Price Discrepancies

8.4 Proposing on Separate Items or in Aggregate(s) –

8.5 Application of Price Proposal Discounts for Evaluating Lowest Price – “Reserved”

9 SUPPORTING DOCUMENTATION REQUIRED PRIOR TO CONTRACT EXECUTION

P-690 (04-26) Request for Proposal Page 4 of 4 Sourcing Event: 0000011913

10 FAILURE TO PROVIDE INSURANCE AND/OR BONDS

11 CITY’S SOCIAL AND ECONOMIC POLICY REQUIREMENTS

11.1 Nondiscrimination Requirements (“Equal Benefits”)

11.2 Payment of Prevailing Wages “Reserved”

11.3 Health Care Accountability Ordinance (HCAO)

11.4 Minimum Compensation Ordinance (MCO)

11.5 First Source Hiring Program

11.6 Sweatfree Procurement – “Reserved”

11.7 Non-Profit Entities

11.8 Other Social Policy Provisions

12 TERMS AND CONDITIONS FOR RECEIPT OF PROPOSALS

12.1 How to Register to propose and be awarded a City Contract

12.2 Proposal Questions and Submissions

12.3 RFP Addenda

12.4 Public Disclosure

12.5 Limitation on Communications During Solicitation

12.6 Proposal Selection Shall not Imply Acceptance

12.7 Cybersecurity Risk Assessment

12.8 Solicitation Errors and Omissions

12.9 Objections to Solicitation Terms

12.10 Protest Procedures

12.11 Proposal Term

12.12 Revision to Proposal

12.13 Proposal Errors and Omissions

12.14 Financial Responsibility

12.15 Proposer’s Obligations under the Campaign Reform Ordinance

12.16 Reservations of Rights by the City

12.17 No Waiver

12.18 Other

P-690 (04-26) Request for Proposal Page 1 of 23 Sourcing Event: 0000011913 9/22/2026

1 RFP Summary

1.1 Introduction

This Request for Proposals (hereinafter “RFP” or “Solicitation”) is being issued by the San Francisco Department of Technology (hereinafter, “DT” or “City”). DT, on behalf of all City departments, is seeking qualified firms (“Proposers”) to provide proposals (“Proposals”) for enterprise identity, directory, access governance, and security professional services on an as-needed basis.

The City seeks qualified firms with demonstrated experience designing, implementing, integrating, migrating, securing, modernizing, and supporting complex enterprise identity environments. Services may include, but are not limited to, Cybersecurity technical services such as architecture, remediation, defense, endpoint security, hardening, identifying vulnerability points, installation of cyber security tools, etc. In addition to, Microsoft Active Directory (“AD”), Microsoft Entra ID, Identity and Access Management (“IAM”), Identity Governance and Administration (“IGA”), Privileged Access Management (“PAM”), Multi-Factor Authentication (“MFA”), Single Sign-On (“SSO”), identity verification and proofing, identity lifecycle management, access governance, cloud identity, application integrations, and physical access and badging integrations.

Through this Solicitation, the City intends to establish a pool of qualified Staffing Firms capable of providing specialized identity, directory, access governance, and cybersecurity professional resources on an as-needed basis.

Award of a contract under this Solicitation does not guarantee the issuance of any Purchase Order, Task Order, or minimum amount of work.

Assignments may include project-based, deliverable-based, advisory, implementation, operational support, or resource-based professional services and may require an individual resource, multiple resources, or a multidisciplinary team. Contractors will be required to propose qualified personnel capable of performing the requested services. The City may review résumés, conduct interviews, assess technical qualifications and relevant experience, evaluate proposed approaches and availability, and consider pricing and other assignment-specific criteria when selecting a Contractor and resource(s) for an assignment.

The following Service Areas are anticipated under this Solicitation. The examples identified within each Service Area are illustrative and are not intended to constitute an exhaustive list of services that may be requested, provided that any requested services are reasonably related to the scope and objectives of this Solicitation.

Service Area 1 – Microsoft Active Directory and Microsoft Entra ID Services

P-690 (04-26) Request for Proposal Page 2 of 23 Sourcing Event: 0000011913

Services may include architecture, assessment, security hardening, migration, consolidation, integration, modernization, troubleshooting, remediation, implementation, administration, and operational support for Microsoft Active Directory, Microsoft Entra ID, Microsoft 365 identity services, hybrid identity environments, and related security and access controls.

Service Area 2 – Identity, Access, Governance, and Security Services

Services may include IAM and IGA architecture, engineering, implementation, integration, administration, and operational support; Privileged Access Management (PAM); Multi-Factor Authentication (MFA); Single Sign-On (SSO); identity lifecycle management; access certification and governance; identity verification and proofing; cloud identity; Zero Trust-aligned identity controls; enterprise application integration; self-service identity capabilities; physical access and badge system integration; authentication and authorization technologies; and other related identity security services.

Service Area 3 – Cybersecurity Professional and Technical Services

Services may include specialized cybersecurity professional, technical, advisory, engineering, implementation, assessment, remediation, and operational support services. Areas of support may include cybersecurity architecture and engineering; cloud security; network security;

endpoint security; vulnerability management; security assessment and testing; incident response; threat detection and monitoring; security operations; application and infrastructure security; data protection; cryptographic and certificate services; security configuration and hardening; security automation and orchestration; security tools implementation and integration; security governance, risk, and compliance; cybersecurity program and project support; and other cybersecurity disciplines reasonably necessary to protect City information systems, technology infrastructure, applications, identities, data, and digital services.

Services under this Service Area may include temporary access to specialized subject matter expertise or technical resources necessary to address project-specific, operational, emerging, or time-sensitive cybersecurity requirements for which the City requires additional professional services capacity or specialized expertise.

Proposers should have resources available for all Service Areas, as applicable to the requirements of this Solicitation.

*Remote candidates are allowed but only within the United States, although local candidates are preferential and some on-site may be required but will be outlined in the post award solicitations if on-site is necessary for that engagement. Depending on the scope of work at the time of the post award solicitation, the hired resource will either be given a city issued Virtual Desktop or a City Owned Laptop.

The City has approximately 65 departments, ranging from small to very large. Some departments maintain facilities located outside the geographic limits of the City. Identity environments, P-690 (04-26) Request for Proposal Page 3 of 23 Sourcing Event: 0000011913 business requirements, applications, security requirements, and technical architectures may vary among City departments.

Services covered by awarded Contract(s) will be requested through individual Purchase Orders and/or Task Orders released against the applicable Contract during the contract term. Each Task Order may identify the specific business need, technical environment, required expertise, scope, deliverables, schedule, service levels, and other project-specific requirements.

The resulting Contract(s) are intended to provide the City with access to specialized professional services as needs arise and do not guarantee any minimum volume or value of work to an awarded Contractor.

1.2 Selection Overview

The City shall award a contract to the top Four (4) Proposers that meet the Minimum Qualifications of this Solicitation and obtain the highest-ranking scores. Responsive Proposals will be evaluated by a panel (“Evaluation Panel”) consisting of one or more parties with expertise related to goods and/or services being procured through this Solicitation. The Evaluation Panel may include staff from various City departments. Proposals will be evaluated based on the criteria outlined herein. If applicable, a Contract Monitoring Division (CMD) Contract Compliance Officer will assess Proposal compliance with Local Business Enterprise (LBE) requirements and assign a rating bonus to Proposal scores. The CMD-adjusted scores (if applicable) will then be tabulated, and Proposers will be ranked starting with the Proposer receiving the highest score, then continuing with the Proposer receiving the second highest score, and so on.

1.3 Anticipated Contract Term

A contract awarded pursuant to this Solicitation shall be non-exclusive with an original term of Three (3) years. The City at its sole, absolute discretion, shall have the option to extend the term for two (2) additional years for a total of Five (5) years.

1.4 Anticipated Contract Not to Exceed Amount

A contract awarded pursuant to this Solicitation shall have a not to exceed (“NTE”) amount of $1,000,000.00 for the initial term. This amount is based on City’s estimated spend over the advertised initial contract term. Should City’s actual spend exceed its estimated spend for the initial term, City may in its sole discretion increase the contract NTE for the initial term. Should City exercise its options to extend the contract beyond the initial term, City may also elect to increase the NTE proportionally.

1.5 Indefinite Quantity, As-Needed Contract

A contract awarded pursuant to this Solicitation will result in a term, indefinite quantities, as-needed contract. There is no guarantee of a minimum amount of goods or services for any of the Proposers selected for contract negotiations or for the awarded Proposer(s). Unless otherwise specified herein, deliveries and services will be required in quantities and at times as

P-690 (04-26) Request for Proposal Page 4 of 23 Sourcing Event: 0000011913 ordered during the period of the contract. Estimated quantities, if any, stated in this Solicitation are approximations only. City, in its sole discretion, may purchase any greater or lesser quantity.

City may also make purchases of items awarded pursuant to this Solicitation from other suppliers when City determines, in its sole discretion, that it is in the best interest of the City to do so.

1.6 Cooperative Purchasing and Use by Other City Departments

Any other City department, public entity or non-profit made up of multiple public entities, may use the results of this Solicitation to obtain some or all of the commodities or services to be provided by Proposer under the same terms and conditions of any contract awarded pursuant to this Solicitation.

1.7 Contract Terms and Negotiations

The successful Proposer will be required to enter into a contract in the form attached hereto as Attachment 1, City’s Contract Terms. City’s Contract Terms are not subject to negotiation.

However, Proposers may identify those contract terms to which they object as part of the questions they submit by the Questions Due Date. City shall evaluate all objections and determine what, if any changes, will be incorporated into City’s Contract Terms prior to the Proposal Due Date. Any such changes will be made known to all Proposers through an Addendum to this Solicitation. Failure to timely execute City’s Contract Terms, or to furnish any and all insurance certificates and policy endorsements, surety bonds or other materials required in City’s Contract Terms, shall be deemed an abandonment of the Proposal and City, in its sole discretion, may select another Proposer and proceed against the original selectee for damages.

2 Solicitation Schedule The anticipated schedule for this Solicitation is set forth below. These dates are tentative and subject to change. It is the responsibility of the Proposer to check for any Addenda to this Solicitation or other published pertinent information.

Proposal Phase Tentative Date

Request for Proposals Issued Tuesday, September 22, 2026 at 10:00 am PST

Pre-Proposal Conference Wednesday, September 30, 2026 at 11:00 am

PST

Microsoft Teams meeting Join:

https://teams.microsoft.com/meet/284941572221494?p=txpE0 MDPoEMcOA7ltY Meeting ID: 284 941 572 221 494 Passcode: KQ9aY7sW

Need help? | System reference Dial in by phone https://teams.microsoft.com/meet/284941572221494?p=txpE0MDPoEMcOA7ltY https://teams.microsoft.com/meet/284941572221494?p=txpE0MDPoEMcOA7ltY https://aka.ms/JoinTeamsMeeting?omkt=en-US https://teams.microsoft.com/l/meetup-join/19%3ameeting_OWNjNjI5MmEtZWM5Ny00MTdlLThlMzQtZTBmMTE5MmY2YWQ5%40thread.v2/0?context=%7b%22Tid%22%3a%2222d5c2cf-ce3e-443d-9a7f-dfcc0231f73f%22%2c%22Oid%22%3a%22b318b952-29c3-4a44-9079-d136878bdbea%22%7d

P-690 (04-26) Request for Proposal Page 5 of 23 Sourcing Event: 0000011913

+1 415-906-4659,,987874779# United States, San Francisco Find a local number Phone conference ID: 987 874 779# For organizers: Meeting options | Reset dial-in PIN

Written Questions Due Date Friday, October 9, 2026 by 10:00 am PST

Proposal Due Date Tuesday, October 20, 2026 by 3:00pm PST (uploaded to PeopleSoft and emailed to contract administrator)

Notice of Intent to Award Week of November 2nd, 2026

Period for Protesting Notice of Intent to Award

Within three (3) business days of the City's issuance of a Notice of Intent to Award.

Contract Administrator: Ken Edhammer Department of Technology Principal Contracts Analyst 1 South Van Ness Ave, 2nd Floor, SF, CA 94103 Phone: 628-652-5093 Email: Kenneth.edhammer@sf.gov

Pre-Proposal Conference Details The Pre-Proposal Conference will begin at the time specified.

Proposers’ representatives are urged to arrive on time. Topics already covered will not be repeated for the benefit of late arrivals. Failure to attend the Pre-Proposal Conference shall not excuse the awarded Proposer from any obligations of a contract awarded pursuant to this Solicitation. Any change or addition to the requirements contained in this Solicitation as a result of the Pre-Proposal Conference will be executed by a written Addendum to this Solicitation. It is the responsibility of the Proposer to check for any Addendum to this Solicitation or other published pertinent information.

3 Requirements for Requested Goods and Services

3.1 Goods and/or Services Requested

This Solicitation is being issued by DT. DT is seeking qualified Proposers to provide Proposals for qualified firms to provide resources with demonstrated experience designing, implementing, integrating, migrating, securing, modernizing, and supporting complex enterprise identity environments in accordance with Appendix A, Scope of Work, to City’s Contract Terms (Attachment 1).

Services may include, but are not limited to, Cybersecurity technical services such as architecture, remediation, defense, endpoint security, hardening, identifying vulnerability points, installation of cyber security tools, etc. In addition to, Microsoft Active Directory (“AD”), Microsoft Entra ID, Identity and Access Management (“IAM”), Identity Governance and Administration (“IGA”), Privileged Access Management (“PAM”), Multi-Factor Authentication (“MFA”), Single Sign-On (“SSO”), identity verification and proofing, identity lifecycle management, access governance, cloud identity, application integrations, and physical access and badging integrations.

tel:+14159064659,,987874779 https://dialin.teams.cloud.microsoft/6ab5bcf2-34a3-4844-8511-4e51fb43f358?id=987874779 https://teams.microsoft.com/meetingOptions/?organizerId=b318b952-29c3-4a44-9079-d136878bdbea&tenantId=22d5c2cf-ce3e-443d-9a7f-dfcc0231f73f&threadId=19_meeting_OWNjNjI5MmEtZWM5Ny00MTdlLThlMzQtZTBmMTE5MmY2YWQ5@thread.v2&messageId=0&language=en-US https://dialin.teams.cloud.microsoft/usp/pstnconferencing mailto:Kenneth.edhammer@sf.gov

P-690 (04-26) Request for Proposal Page 6 of 23 Sourcing Event: 0000011913

The Solicitation is intended to establish a pool of qualified Staffing Firms capable of providing specialized identity and security professional services in the following Service Areas:

Service Area 1 – Microsoft Active Directory and Microsoft Entra ID Services

Services may include architecture, assessment, security hardening, migration, consolidation, integration, modernization, troubleshooting, remediation, implementation, administration, and operational support for Microsoft Active Directory, Microsoft Entra ID, Microsoft 365 identity services, hybrid identity environments, and related security and access controls.

Service Area 2 – Identity, Access, Governance, and Security Services

Services may include IAM and IGA architecture, engineering, implementation, integration, administration, and operational support; Privileged Access Management (PAM); Multi-Factor Authentication (MFA); Single Sign-On (SSO); identity lifecycle management; access certification and governance; identity verification and proofing; cloud identity; Zero Trust-aligned identity controls; enterprise application integration; self-service identity capabilities; physical access and badge system integration; authentication and authorization technologies; and other related identity security services.

Service Area 3 – Cybersecurity Professional and Technical Services

Services may include specialized cybersecurity professional, technical, advisory, engineering, implementation, assessment, remediation, and operational support services. Areas of support may include cybersecurity architecture and engineering; cloud security; network security;

endpoint security; vulnerability management; security assessment and testing; incident response; threat detection and monitoring; security operations; application and infrastructure security; data protection; cryptographic and certificate services; security configuration and hardening; security automation and orchestration; security tools implementation and integration; security governance, risk, and compliance; cybersecurity program and project support; and other cybersecurity disciplines reasonably necessary to protect City information systems, technology infrastructure, applications, identities, data, and digital services.

Proposers must have resources in all services area.

3.2 Regulatory and Compliance Requirements Specific to the Goods/Services Solicited “Reserved”.

3.2.1 Web Content Accessibility Guidelines (WCAG) 2.1 Level AA – “Reserved”.

3.2.2 Green Purchasing Requirements – “Reserved”.

3.3 Alternates and Samples – “Reserved”.

3.4 Freight on Board and Shipping Costs – “Reserved”.

P-690 (04-26) Request for Proposal Page 7 of 23 Sourcing Event: 0000011913

3.5 Additional Purchases – “Reserved”.

4 Local Business Enterprise (LBE) Program Requirements

4.1 CMD Compliance Officer

The CMD Compliance Officer (CCO) for this Solicitation and any Contract awarded pursuant to this Solicitation is:

LBE Certification Unit Contract Monitoring Division City and County of San Francisco Tel: 415.554.XXXX Email: LBEcert@sfgov.org Website: www.sfgov.org/cmd.

4.2 Application of LBE Rating Bonuses

San Francisco Micro, Small, and SBA LBE bidders certified by the Contract Monitoring Division are eligible for a rating bonus. LBE Rating Bonuses are applied to Proposers’ scores at each phase of the Solicitation evaluation and selection process, including the price proposal evaluation in accordance with the Rating Bonus values shown below.

4.2.1 Commodities – “Reserved”.

4.2.2 General and Professional Services

Estimated Contract Value, per Agreement

Small/Micro LBEs Rating Bonus

SBA LBEs Rating Bonus

Greater than $20,000 but less than or equal to $400,000.

10% 0%

Greater than $400,000 but less than or equal to $10,000,000.

10% 5% So long as it does not adversely affect a Small or Micro-LBE Proposer’s participation or, for Professional Services, an JV Proposer’s participation.

Greater than $10,000,000 but less than or equal to $20,000,000.

2% 2%

4.2.3 Professional Services by Joint Ventures

Estimated Contract Value, per Agreement

Percent Share of JV/Prime Work by Small or Micro-LBE Prime

Rating Bonus mailto:LBEcert@sfgov.org http://www.sfgov.org/cmd

P-690 (04-26) Request for Proposal Page 8 of 23 Sourcing Event: 0000011913

Greater than $20,000 but less than or equal to $10,000,000.

Equals or exceeds 35%, but less than 40%

5%

Equals or exceeds 40%, but less than 100%

7.5%

100% 10%

If applying for an LBE rating discount as a Joint Venture (JV), the Micro and /or Small-LBE must be an active partner in the JV and perform work, manage the job and take financial risks in proportion to the required level of participation stated in the Proposal, and must be responsible for a clearly defined portion of the work to be performed and share in the ownership, control, management responsibilities, risks, and profits of the JV. The portion of the Micro and/or Small-LBE JV’s work shall be set forth in detail separately from the work to be performed by the non-LBE JV. The Micro and/or Small-LBE JV’s portion of the contract must be assigned a commercially useful function.

4.2.4 Sample Rating Bonus Calculations

ABC Firm Price Proposal Attributes

• Is a Certified Micro

LBE

Possible Maximum Score

14B LBE Rating Bonus (10%)

Evaluated Total Score

Minimum Qualifications Pass N/A N/A

Written Proposal 100 10 110

Price Proposal Score 50 5 55

Total 150 15 165

4.3 LBE Subcontracting Participation Requirements

There shall be no LBE Subcontracting Requirement for any Contract awarded pursuant to this Solicitation because the LBE Subcontracting Requirements were waived by the Contract Monitoring Division.

4.4 CMD LBE Forms – “Reserved.”

4.5 LBE Payment and Utilization Tracking – “Reserved.”

5 Proposal Evaluation Criteria

Evaluation Phase Maximum Points

Minimum Qualifications Documentation Pass/Fail

P-690 (04-26) Request for Proposal Page 9 of 23 Sourcing Event: 0000011913

Price Proposal 20

Written Proposal 80

TOTAL 100 Points

6 Minimum Qualifications and Documentation Required with Proposal (Pass/Fail) Proposers must provide documentation that clearly demonstrates each Minimum Qualification (MQ) listed below has been met. Minimum Qualification documentation should be clearly marked as “MQ1”, MQ2”, etc. … to indicate which MQ it supports. Each Proposal will be reviewed for initial determination on whether Proposer meets the MQs referenced in this section. This screening is a pass or fail determination and a Proposal that fails to meet the Minimum Qualifications will not be eligible for further consideration in the evaluation process. The City reserves the right to request clarifications from Proposers prior to rejecting a Proposal for failure to meet the Minimum Qualifications.

MQ # Description

MQ 1 Completed Attachment 2, Proposer Questionnaire and References

MQ 2 Completed Attachment 5, City Price Proposal

MQ3A –

Service Area 1 Qualification

To qualify for Service Area 1, the Proposer must document at least two (2) client engagements within the past five (5) years in which it provided professional services or professional resources supporting Microsoft Active Directory and/or Microsoft Entra ID. At least one engagement must have included migration, consolidation, modernization, integration, or security hardening. - Engagement information identifying client, dates, relevant technology/services and Proposer's role.

MQ3B –

Service Area 2 Qualification

To qualify for Service Area 2, the Proposer must document at least two (2) client engagements within the past five (5) years in which it provided professional services or professional resources involving one or more of the following: IAM, IGA, PAM, MFA, SSO, identity lifecycle management, access governance, identity verification/proofing, cloud identity, or related identity security services. - Engagement information identifying client, dates, relevant technology/services and Proposer's role.

MQ3C –

Service Area 3 Qualification

To qualify for Service Area 3, the Proposer must document at least two (2) client engagements within the past five (5) years in which it provided cybersecurity professional services or specialized cybersecurity resources.

The two engagements, collectively, must demonstrate experience in at least two (2) distinct cybersecurity disciplines, which may include cybersecurity architecture or engineering; cloud security; network security; endpoint security;

P-690 (04-26) Request for Proposal Page 10 of 23 Sourcing Event: 0000011913 vulnerability management; security assessment or testing; incident response;

threat detection or monitoring; security operations; application or infrastructure security; data protection; cryptographic or certificate services; security configuration or hardening; security automation or orchestration; security tools implementation or integration; or cybersecurity governance, risk, and compliance.

At least one engagement must have included the provision of specialized technical cybersecurity personnel or subject matter expertise supporting implementation, engineering, assessment, remediation, operations, or other technical cybersecurity activities.

Required documentation: Engagement information identifying the client, dates of performance, cybersecurity discipline(s), relevant technologies or services, scope of work, and the Proposer’s role.

7 Written Proposal (80 Points) In addition to submitting documents supporting each Minimum Qualification as required by this Solicitation, Proposers shall also submit a complete Proposal consisting of each item set forth

Please submit the following information, in the order specified below. Please note the following:

1. Introduction and Executive Summary (up to two pages)

Submit a letter of introduction and executive summary of the proposal. The letter must be signed by a person authorized by the Proposer to obligate the Proposer to perform the commitments contained in the proposal. Submission of the letter will constitute a representation by the Proposer that the Proposer is willing and able to perform the commitments contained in the proposal.

2. Proposer’s Minimum Qualifications (up to ten pages) – 10 pts

Proposers must demonstrate that they meet the City’s minimum qualifications, which are not subject to negotiation.

Experience:

Comparable Client References At least three (3) client references for comparable enterprise IAM engagements completed or supported within the past seven years, preferably including California state/local government.

Large-Scale IAM Implementation Experience

P-690 (04-26) Request for Proposal Page 11 of 23 Sourcing Event: 0000011913

Demonstrated successful IAM implementations supporting at least 50,000 identities and 100+ applications, including enterprise integrations and preferably public-sector environments.

Enterprise IAM Experience Minimum 10 years of organizational experience delivering enterprise IAM, IGA, PAM, MFA, SSO, identity lifecycle, identity security, AD/Entra ID, cloud identity, and related services in complex production environments.

3. Staffing Qualifications (MQ 3a, 3b, and 3c – 10 pages - 60pts total)

Proposals must include information that demonstrate Proposer complies with City requirements, that their staffing resources have the following skill sets, including but not limited to the following:

Service Area 1: Active Directory & Microsoft Entra ID Resources (20pts)

Proposed resources must have a minimum of five (5) years of relevant enterprise experience designing, implementing, migrating, securing, integrating, or supporting Microsoft Active Directory and Microsoft Entra ID in complex production environments.

Resources must demonstrate applicable hands-on experience with:

• AD migrations and consolidations, including domains, users, groups, devices, GPOs, DNS, trusts, applications, and service accounts.

• AD and Entra ID security hardening using Microsoft, CIS, NIST, Zero Trust, or comparable industry practices.

• Entra ID security and access controls, including MFA, Conditional Access, Identity Protection, privileged access, and Microsoft 365 security.

• Integration of AD and Entra ID with IAM, SSO, cloud, governance, and enterprise application platforms.

• Relevant Microsoft identity, security, architecture, cloud, or comparable industry certifications, as applicable to the proposed role.

Service Area 2: Identity, Access, Governance & Security Resources (20 pts)

Proposed resources must have a minimum of five (5) years of relevant enterprise IAM and security experience designing, implementing, integrating, securing, or supporting IAM solutions in complex production environments.

Resources must demonstrate applicable hands-on experience with:

• IAM/IGA, PAM, MFA, SSO, identity lifecycle management, access governance/certification, identity verification, self-service identity management, and Zero Trust.

P-690 (04-26) Request for Proposal Page 12 of 23 Sourcing Event: 0000011913

• Enterprise IAM technologies such as Oracle IAM/OIG/OAG/OCI, BeyondTrust, or comparable platforms.

• Identity standards and integrations including SAML, OAuth 2.0, OIDC, LDAP/LDAPS, APIs, cloud identity services, enterprise applications, and authoritative data sources.

• Integration with physical access/badge management systems, where applicable.

• Designing and supporting secure, scalable, and highly available enterprise IAM environments.

• Relevant identity, cloud, cybersecurity, architecture, platform, or comparable industry certifications, as applicable to the proposed role.

Service Area 3 – Cybersecurity Professional and Technical Services (20 pts)

• Services may include specialized cybersecurity professional, technical, advisory, engineering, implementation, assessment, remediation, and operational support services.

Areas of support may include cybersecurity architecture and engineering; cloud security;

network security; endpoint security; vulnerability management; security assessment and testing; incident response; threat detection and monitoring; security operations;

application and infrastructure security; data protection; cryptographic and certificate services; security configuration and hardening; security automation and orchestration;

security tools implementation and integration; security governance, risk, and compliance;

cybersecurity program and project support; and other cybersecurity disciplines reasonably necessary to protect City information systems, technology infrastructure, applications, identities, data, and digital services.

4. Availability of Resources (10 points) – (2 pages)

1. Proof they have multiples resources in the services areas for when a project need arises.

Proposers are evaluated on the firm’s proven ability to provide the quality of service required. This evaluation includes the results of reference checks

Proposers are evaluated on whether the firm’s engineer resources meet the City’s requirements for training, certification, availability, and quality of work.

Answers must be provided in the order listed in this RFP and limited to the length indicated.

Answers must be based on verifiable statistics and data (e.g., “In 2025 our firm completed 10 staffing projects under contract for the County of X,) rather than qualitative statements (e.g., “Our firm is the best cybersecurity staffing firm in Northern California.”).

P-690 (04-26) Request for Proposal Page 13 of 23 Sourcing Event: 0000011913

Proposals must include evidence and explanations demonstrating Proposer’s ability to provide all the services described and to comply with all requirements described. Proposers should note that some sections include requests for specific types of information or responses.

In responding to each section, Proposers may propose alternatives that may promote efficiencies to the City over those indicated in the RFP. Any alternatives will be in addition to— not instead of—Proposers’ direct responses regarding the ability to the meet the stated requirements. The City will examine all alternatives and will consider whether they are relevant to the evaluation of the Proposal.

8 Price Proposal (Choose: 20 Points)

8.1 Price Proposal Format and Allocation of Points

In addition to submitting documents supporting each Minimum Qualification as required by this Solicitation, Proposers shall also submit a complete Price Proposal consisting of each item set forth in Attachment 5, Price Proposal Template. The total points allocated to the Lowest Proposed Price shall be determined as follows:

(Lowest Average Hourly Rate / Proposer’s Average Hourly Rate) x (Maximum Points possible for Price).

8.2 Price Proposal Evaluation Period

The City will attempt to evaluate Price Proposals within fifteen (15) days after receipt of Proposals. If City requires additional evaluation time, all Proposers will be notified in writing of the new expected award date.

8.3 Price Discrepancies

Where applicable, if there is a discrepancy between the Price Proposal and pricing entered by Proposer into the Supplier Portal, the Price Proposal pricing will prevail. In the event of a discrepancy between the unit price and the extended price, the unit price will prevail.

8.4 Proposing on Separate Items or in Aggregate(s) –

Single Aggregate: This Solicitation will result in the evaluation and award of one Aggregate consisting of one or more lines on the Price Proposal Template. The proposed price for the Aggregate shall equal the total cost of all line items within that Aggregate and shall be evaluated against other Price Proposals, after being reduced by any Local Tax discounts and/or Prompt Payment discounts, and after application of any LBE rating bonuses. Proposed prices shall be exclusive of sales tax.

Proposer must provide the City with pricing that is equal to or better than the best pricing offered to any other customer.

P-690 (04-26) Request for Proposal Page 14 of 23 Sourcing Event: 0000011913

8.5 Application of Price Proposal Discounts for Evaluating Lowest Price – “Reserved”

9 Supporting Documentation Required Prior to Contract Execution Proposers must provide each Required Supporting Documentation (“RSD”) identified below prior to Award. Failure to do so may result in the Proposal being deemed Non-Responsive.

RSD#1

Evidence that Proposer is compliant or likely to become compliant within 30 calendar days of the Proposal Due Date with San Francisco Labor and Employment Code Articles 131 and 132 (formerly known as Equal Benefits – 12B).

RSD#2 Insurance in accordance with Article 5 of Attachment 1, City’s Contract Terms.

RSD#3 –

only if proposer is a Non- Profit

Non-Profit Entities: If Proposer is a non-profit organization and receives a cumulative total per year of at least $250,000 in City funds or City-administered funds:

(1) a statement describing Proposer’s efforts to comply with the Chapter 12L provisions regarding public access to Proposer’ s meetings and records, and

(2) a summary and disposition of all complaints concerning the Proposer’s compliance with Chapter 12L that were filed with the City in the last two years and deemed by the City to be substantiated. If no such complaints were filed, the Proposer shall include a statement to that effect.

Failure to comply with the reporting requirements of Chapter 12L or material misrepresentation in Proposer’s Chapter 12L submissions shall be grounds for rejection of the Proposal and/or termination of any subsequent agreement reached on the basis of the Proposal.

10 Failure to Provide Insurance and/or Bonds Unless otherwise stated, within ten business days of the receipt of a notice of award of a Contract, the Proposer to whom the contract is awarded shall deliver the specified bond documents and/or insurance certificates and policy endorsements to City. If the Proposer fails or refuses to furnish the required bond and/or insurance within ten days after receiving notice to award a Contract, City may, at its option, determine that the Proposer has abandoned its Proposal. The foregoing in no way limits the damages which are recoverable by City whether or not defined elsewhere in the contract documents.

11 City’s Social and Economic Policy Requirements The San Francisco Municipal Code establishes a number of requirements for people seeking to do business with the City (“Social and Economic Policy Requirements”). These Social and Economic Policy Requirements can be found in Attachment 1, City’s Contract Terms, which

P-690 (04-26) Request for Proposal Page 15 of 23 Sourcing Event: 0000011913

Proposers are encouraged to carefully review. The Social and Economic Policy Requirements set forth below are not intended to be a complete list of all Social Policy Requirements applicable to this Solicitation and any contracts awarded from it.

11.1 Nondiscrimination Requirements (“Equal Benefits”)

Proposers awarded any contract exceeding $230,000 (the City’s “Minimum Competitive Amount”), may not, during the term of the Contract discriminate in the provision benefits between employees with domestic partners and employees with spouses, and/or between the domestic partners and spouses of such employees, where the domestic partnership has been registered with a governmental entity pursuant to state or local law authorizing such registration. This Equal Benefits requirement applies in any of the contractor’s operations in San Francisco, on real property owned by San Francisco, or where work is being performed for the City elsewhere in the United States, subject to the conditions set forth in San Francisco Labor and Employment Code Articles 131 and 132. Contractors must submit a declaration confirming that the business complies with the Equal Benefits law. The declaration is available via SF City Partner Supplier Portal. Refer to Attachment 1, City’s Contract Terms for additional details related to the application of this Ordinance to a contract awarded pursuant to this Solicitation. For more information, visit the Contract Monitoring Division (CMD) website.

11.2 Payment of Prevailing Wages “Reserved”

11.3 Health Care Accountability Ordinance (HCAO)

A Proposer selected pursuant to this Solicitation shall comply with Labor and Employment Code Article 121 For each Covered Employee, the awarded Contractor shall provide the appropriate health benefit set forth in Article 121.3. If the awarded Contractor chooses to offer the health plan option, such health plan shall meet the minimum standards set forth by the San Francisco Health Commission. Information about and the text of Article 121, as well as the Health Commission’s minimum standards, is available on the web at http://sfgov.org/olse/hcao. An awarded Contractor is subject to the enforcement and penalty provisions in Article 121. Any Subcontract entered into by the awarded Contractor shall require any Subcontractor with 20 or more employees to comply with the requirements of the HCAO and shall contain contractual obligations substantially the same as those set forth in this Section. Refer to Attachment 1, City’s Contract Terms for additional details related to the application of this Policy to a contract awarded pursuant to this Solicitation.

11.4 Minimum Compensation Ordinance (MCO)

A Proposer selected pursuant to this Solicitation shall comply with Labor and Employment Code Article 111. For each Covered Employee, the awarded Contractor shall pay no less than the minimum compensation required by San Francisco Labor and Employment Code Article 111, including a minimum hourly gross compensation, compensated time off, and uncompensated time off. An awarded Contractor is subject to the enforcement and penalty provisions in Article

111. Information about and the text of Article 111 is available on the web at http://sfgov.org/olse/mco. An awarded Contractor is required to comply with all of the applicable provisions of Article 111, irrespective of the listing of obligations in this Section. Refer https://www.sf.gov/equal-benefits-program http://sfgov.org/olse/hcao http://sfgov.org/olse/mco

P-690 (04-26) Request for Proposal Page 16 of 23 Sourcing Event: 0000011913 to Attachment 1, City’s Contract Terms for additional details related to the application of this Policy to a contract awarded pursuant to this Solicitation.

11.5 First Source Hiring Program

A Proposer selected pursuant to this Solicitation shall comply with all of the applicable provisions of the First Source Hiring Program, Chapter 83 of the San Francisco Administrative Code. Refer to Attachment 1, City’s Contract Terms for additional details related to the application of this Policy to a contract awarded pursuant to this Solicitation.

11.6 Sweatfree Procurement – “Reserved”

11.7 Non-Profit Entities

To receive a contract under this Solicitation, any nonprofit Proposer must be in good standing with the California Attorney General’s Registry of Charitable Trusts by the time of contract execution and must remain in good standing during the term of the agreement. Upon request, Proposer must provide documentation to the City demonstrating its good standing with applicable legal requirements. If Proposer will use any nonprofit subcontractors to perform the agreement, Proposer will be responsible for ensuring they are also in compliance with all requirements of the Attorney General’s Registry of Charitable Trusts at the time of Contract execution and for the duration of the agreement.

11.8 Other Social Policy Provisions

Attachment 1, City’s Contract Terms, identifies the City’s applicable social policy provisions related to a contract awarded pursuant to this Solicitation. Proposers are encouraged to carefully review these terms and ensure they are able to comply with them.

12 Terms and Conditions for Receipt of Proposals

12.1 How to Register to propose and be awarded a City Contract To submit a proposal for a City contract, all vendors must be registered as a City BIDDER or a SUPPLIER. To be awarded a contract, Proposers must convert their BIDDER ID to a SUPPLIER ID, which requires additional steps to demonstrate compliance with certain San Francisco supplier requirements.

12.1.1 Registering as a BIDDER to propose on a City contract

Proposers that are not currently a City SUPPLIER must obtain a BIDDER ID by completing the following form on the SF City Partner Portal:

https://sfcitypartner.sfgov.org/pages/BidderRegistration-BS3/bidder-registration-1.aspx

12.1.2 Converting a BIDDER ID to SUPPLIER ID to be awarded a City contract

To convert a BIDDER ID to a SUPPLIER ID, awarded Proposers are required to register with the City Tax Collector’s Office. Additionally, businesses awarded contracts exceeding $230,000 (the https://sfcitypartner.sfgov.org/pages/BidderRegistration-BS3/bidder-registration-1.aspx

P-690 (04-26) Request for Proposal Page 17 of 23 Sourcing Event: 0000011913

“Minimum Competitive Amount”) must comply with the City’s Equal Benefits requirements pursuant to Labor and Employment Code Article 131 and must submit the online Equal Benefits Declaration through the SF City Partner Portal.

For detailed instructions on registering for City Business Tax, submitting an Equal Benefits Declaration, and for converting your BIDDER ID to a SUPPLIER ID visit Contracting with the City and County of San Francisco.

• City Business Tax Registration Inquiries: For questions regarding business tax registration procedures and requirements, visit Register a Business | Treasurer & Tax Collector, contact the Tax Collector’s Office at (415) 554-4400 or, if calling from within the City and County of San Francisco, 311.

• Equal Benefits Program Inquiries: For questions concerning the San Francisco Labor and Employment Code Articles 131 and 132, go to: www.sfgov.org/cmd.

12.2 Proposal Questions and Submissions

12.2.1 Proposer Questions and Requests for Clarification

Proposers shall address any questions regarding this Solicitation to the Contract Administrator whose name and contact information appears on the cover page of this Solicitation. Proposers who fail to submit questions concerning this Solicitation and its requirements will waive all further rights to protest based on the specifications and conditions herein. Questions must be submitted by email to the Contract Administrator whose name and contact information appears on the cover page of this Solicitation no later than Written Questions Due Date. A written Addendum will be executed addressing each question and answer and posted publicly.

It is the responsibility of the Proposer to check for any Addenda and other updates that will be posted on the City’s Supplier Portal: https://sfcitypartner.sfgov.org/pages/Events-BS3/event-search.aspx.

12.2.2 Proposal Format

Proposals must be submitted using the attached submission forms and/or created using word processing software (e.g. Microsoft Word or Excel) and typed in a legible font (e.g.-Arial, Times New Roman, etc.). The document must have page margins of at least .5” on all sides.

Information must be provided at a level of detail that enables effective evaluation and comparison between Proposals. Failure to follow formatting, submission, or content requirements, as well as page limit restrictions (if any), may negatively impact the evaluation of your Proposal.

12.2.3 Time and Place for Submission of Proposals

Prior to the Proposal submission deadline, Proposers must upload their complete Proposals into the City’s Supplier Portal: https://sfcitypartner.sfgov.org/pages/index.aspx. Late submissions will not be considered.