Security_Awareness_Learning_and_User_Education_Platform.pdf

TSD-20261929

SECURITY AWARENESS LEARNING AND USER

EDUCATION PLATFORM

County of San Mateo

455 County Center, 3rd Fl undefined

Redwood City, CA, CA 94063

RELEASE DATE: April 17, 2026

DEADLINE FOR QUESTIONS: April 30, 2026

RESPONSE DEADLINE: May 14, 2026, 1:00 pm

RESPONSES MUST BE SUBMITTED ELECTRONICALLY TO:

https://secure.procurenow.com/portal/smcgov https://secure.procurenow.com/portal/%7bproject.government.code%7d

County of San Mateo

Security Awareness Learning and User Education Platform

1. Introduction

2. Scope of Work

3. Evaluation Phases

4. Vendor Questionnaire

Attachments:

A - Attachment_A_RFP_TSD-20261929_Security_Awareness_Learning_and_User_Education_Platform

B - Attachment_B_Price_Proposal_Template

C - Attachment_C_References_Template

D - Attachment_D_Standard_Contract_Template

E - Attachment_E_Technology_Security_Assessment

F - Attachment_F_SMC_Local_Preference_Self-Attestation_Form

1. Introduction

1.1. Summary

The County of San Mateo (County) is seeking proposals from well qualified proposers to provide security awareness training and education through a rich, multi-media platform, countywide. Functionality should be robust and provide real world examples and testing of personnel for common security awareness subjects such as phishing business email compromise (BEC) and other areas.

1.2. Contact Information

Jason Li Contract Administrator Email: isd_solicitations@smcgov.org Phone: (650) 363-4548

Department:

Technology Services

Department Head:

Director/Chief Information Officer

1.3. Timeline

Release Project Date April 17, 2026

Pre-Proposal Meeting (Non-Mandatory) April 27, 2026, 1:00pm

Time: 1:00pm-1:15pm This meeting is to address administrative questions only regarding OpenGov.

No technical or specific questions to the RFP will be answered at this meeting.

Microsoft Teams meeting Join:

https://teams.microsoft.com/meet/23146061993382

?p=zz7QbBAZwmbkLU2IDB Meeting ID: 231 460 619 933 82 Passcode: Hx7hv6mm

Dial in by phone +1 628-212-0105 United States, Corte Madera Phone conference ID: 541 156 378#

Question Submission Deadline April 30, 2026, 1:00pm mailto:isd_solicitations@smcgov.org tel:(650)363-4548 https://teams.microsoft.com/meet/23146061993382?p=zz7QbBAZwmbkLU2IDB https://teams.microsoft.com/meet/23146061993382?p=zz7QbBAZwmbkLU2IDB

Proposal Submission Deadline May 14, 2026, 1:00pm

2. Scope of Work

2.1. Project Scope and Documents

See Attachments.

https://procurement.opengov.com/portal/smcgov/projects/253599/document?section=2426794

3. Evaluation Phases

3.1. Phase 1

No. Evaluation Criteria Scoring Method Weight (Points)

1. Evaluation of Technical Proposal

45% - Method and approach

• Apparent understanding of the scope of services to be provided

• Appropriateness of the proposed solution/services

30% - Experience and organizational capacity

• Qualifications and experience of both the proposer and key personnel

• Experience with other public agencies

• Organizational resources and staff, apparent ability to meet any required timelines or other requirements

25% - Price

10% Preferential Points

Where price is not the sole evaluation factor for a solicitation (e.g., in the case of a "best-value" solicitation), five percent (5%) of the total evaluation points awardable will be added to the proposal score for each Local Business or

Local Non-Profit score for evaluation purposes.

In the event of a tie between a Local Business or Local Non-Profit and another bidder, the

Local Business or Non-Profit shall be awarded the Contract, assuming agreement on other contract terms.

An additional three percent (3%) preference shall be given to a Local Business or Local

Non-profit (for a total of eight percent (8%) of total points awardable) if the proposer is a

Small Business or Small Non-Profit, or an additional 5 percent preference (for a total of ten percent (10%) of total points awardable) if the proposer is a Micro Business or Micro Non-

Profit.

0-100 Points 110 (100% of Total)

3.2. Phase 2

No. Evaluation Criteria Scoring Method Weight (Points)

1. Evaluation of Demonstration/Interviews of elevated proposals

100%- Demonstration

• Ability to fully integrate user population through SAML

• Education and campaign reporting platforms

• Ability to report success failure by population groups, minimum of 30

(departments, divisions etc.)

• Ability to setup training and testing campaigns based on specific types of content, i.e. PII/HIPAA/CJI

• Ability to select topics to generate a continuous security awareness training video including ease of use.

• Vendor must demonstrate a variety of current topics to select from that would be applicable to various levels of training.

• Demonstration must include available phishing campaigns, ease of use in setting up, include sample phishing emails, and reporting information.

• Security awareness campaign must demonstrate risk areas and suggested areas of improvement.

Points Based 100 (100% of Total)

4. Vendor Questionnaire

4.1. Minimum Qualifications and Requirements: The Proposer has a minimum five (5) years operating in a production environment and supporting government customers with the requirements detailed in this RFP. *

The Proposer confirms the minimum qualification is met, and the proposal contains a detailed response.

☐ Please confirm

*Response required

4.2. Minimum Qualifications and Requirements: The Proposer has a minimum three (3) years’ experience implementing the requested solution, performing similar services as those detailed in this RFP.*

The Proposer confirms the minimum qualification is met, and the proposal contains a detailed response.

☐ Please confirm

*Response required

4.3. Minimum Qualifications and Requirements: The Proposer has a minimum three (3) successful implementations for government agencies of similar size and requirements within the last five (5) years.*

The Proposer confirms the minimum qualification is met, and the proposal contains a detailed response.

☐ Please confirm

*Response required

4.4. Minimum Qualifications and Requirements: Provide evidence of the insurance requirements for each of the checked categories as outlined in Section IV-Insurance. The Proposer understands that expired certificates will not meet this requirement.*

The Proposer confirms this minimum qualification is met, and a copy of the Certificate of Insurance

(COI) has been uploaded. The Proposer has reviewed the COI, and confirms all coverage limits meets or exceed the RFP requirements

☒ General Liability (Including operations, products and completed operations, as applicable.)

$1,000,000 - per occurrence for bodily injury, personal injury and property damage. If Commercial General Liability Insurance or other form with a general aggregate limit is used, the general aggregate limit either must apply separately to this project or must be twice the required occurrence limit.

To be carried at all times during the term of the Contract

☒ Automobile Liability $1,000,000 - per accident for bodily injury and property damage.

To be carried at all times during the term of the Contract

☒ Workers’ Compensation As required by the State of California

To be carried at all times during the term of the Contract

☒ Employers’ Liability $1,000,000 - each accident, $1,000,000 policy limit bodily injury by disease, $1,000,000 each employee bodily injury by disease.

To be carried at all times during the term of the Contract

☐ Professional Liability (Errors and Omissions) $1,000,000 - per occurrence.

To be carried at all times during the term of the Contract

☐ Cyber Liability $5,000,000 per occurrence for Privacy and Network Security, $1,000,000 per occurrence for Technology Errors and Omissions

To be carried at all times during the term of the Contract and for three years thereafter.

Upload Certificate of Insurance (COI)

4.5. Minimum Qualifications and Requirements: System for Award Management (SAM)

Confirmation (Part 1)*

Vendor certifies that at the time of bid submission, they are not currently debarred, suspended, proposed for debarment, declared ineligible, or excluded by any Federal or State of California departments or agency from doing business with the Federal Government or the State of California. Please confirm your firm is registered with the System for Award Management (SAM). Bidder is required to be in good standing with https://sam.gov/SAM/.

Please note: sam.gov assigns Unique Entity ID’s, however, to meet this minimum qualification, the Registration Status in sam.gov must also be listed as “Active Registration”. Incomplete registrations will not meet this requirement.

☐ Please confirm

*Response required

4.6. Minimum Qualifications and Requirements: System for Award Management (SAM) Registered

Business Name (Part 2)*

Please enter the Business Name your firm is registered under in the System for Award Management

(SAM).

*Response required

4.7. Minimum Qualifications and Requirements: System for Award Management (SAM) UEI (Unique

Entity ID) No. (Part 3)*

Please enter the UEI (Unique Entity ID) No. your firm is registered under in the System for Award

Management (SAM).

*Response required

4.8. Proposal: Comply to the proposal content requirements stated in Attachment A, Section 2.2.*

(Do not include pricing in this area) https://sam.gov/SAM/

4.9. Attachment B: Price Proposal Template*

The Proposer confirms Attachment B: Price Proposal Template has been completed and uploaded.

(Upload Attachment B)

*Response required

4.10. Attachment C: References*

The Proposer confirms Attachment C: References has been completed and uploaded.

(Upload Attachment C)

*Response required

4.11. Attachment D: County Standard Contract Template (Part 1)*

If requested redlines are not submitted, the proposer confirms their acceptance to the terms and conditions in the County's Standard Contract Template without modifications.

If requesting redlines for County's consideration, proposer has included them with the proposer's submission. Please refer to #10 for instructions on how to upload.

☐ Please confirm

*Response required

4.12. Attachment D: County Standard Contract Template (Part 2)*

Proposer's requested redlines to the County Standard Contract Template are submitted for County's review and consideration. Proposers should not rely on the County's agreement to modified terms.

(Upload proposed redlines. Microsoft Word is preferred)

*Response required

4.13. Attachment E: Technology Security Assessment*

The Proposer confirms Attachment E: Technology Security Assessment has been completed and uploaded.

(Upload Attachment E)

*Response required

4.14. Procurement Preference for Local Businesses and Local Non-Profits

The board of Supervisors adopted the Local, Local Small and Micro Business ordinance on November 19, 2024. The purpose of this ordinance is to promote a strong local economy by giving preference to local businesses, and local small and micro businesses, to the extent consistent with the law and interests of the public.

4.14.1. Is the Proposer a San Mateo County "Local Business"?*

As Defined by Chapter 2.89.020 of the San Mateo County Ordinance Code, a “Local Business” means any for-profit business which has its principal place of business, or is headquartered, in San Mateo

County.

☐ Yes

☐ No

When equals "Yes"

4.14.2. If the Proposer is a San Mateo County local business,*

Please download the below documents, complete, and upload.

• Attachment_F_SMC_Local_Pref...

*Response required

4.14.3. Is the Proposer a "Non-Profit?*

A Non-Profit is defined as a tax-exempt public charity organization (within the meaning of section

501(c)(3) of the Internal Revenue Code) that is formed for purposes other than making a profit, is exempt from paying federal income taxes on the income generated for their exempt purposes.

☐ Yes

☐ No

*Response required

When equals "Yes"

4.14.4. If yes, is the Proposer a San Mateo County "Local Non-Profit"?*

As Defined by Chapter 2.89.020 of the San Mateo County Ordinance Code, a “Local Non-Profit" means a tax-exempt public charity organization (within the meaning of section 501(c)(3) of the

Internal Revenue Code) that is formed for purposes other than making a profit, is exempt from paying federal income taxes on the income generated for their exempt purposes, and has its principal place of business, or is headquartered, in San Mateo County. If this designation applies to the proposer, a self-attestation form must be completed and provided with this response.

Please download the below documents, complete, and upload. If this designation is not applicable, please leave blank.

• Attachment_F_SMC_Local_Pref...

*Response required

4.14.5. Is the Proposer a "Small" or "Micro" Business located in San Mateo County?*

As Defined by Chapter 2.89.020 of the San Mateo County Ordinance Code:

“Local Small Business” means any business which holds a Small Business Certification awarded by the

California Office of Small Business and Disabled Veteran Business Enterprise Services (OSDS), and has its principal place of business, or is headquartered, in San Mateo County.

“Local Micro Business” means any Small Business certified by the OSDS which is automatically designated by the OSDS as a Micro Business due to gross annual receipts falling below the OSDS-designated dollar amount, and has its principal place of business, or is headquartered, in San Mateo

County.

☐ Yes https://government-project.s3.us-west-2.amazonaws.com/253599/806e7957-7480-453a-b607-7bd4405e137d_Attachment_F_SMC_Local_Preference_Self-Attestation_Form.pdf https://government-project.s3.us-west-2.amazonaws.com/253599/595f2b02-84f6-4439-a6ba-ccc4d8a76595_Attachment_F_SMC_Local_Preference_Self-Attestation_Form.pdf

☐ No

When equals "Yes"

4.14.6. If the Proposer is a small or local business located in San Mateo County,*

Please provide the OSDS provided Certification ID. Include the Proposer's name and the RFP title and number in each filename.

*Response required

4.14.7. Is the Proposer a "Small" or "Micro" Non-Profit located in San Mateo County?*

As Defined by Chapter 2.89.020 of the San Mateo County Ordinance Code:

“Local Small Non-Profit" means a Local Non-Profit with an annual revenue of $1,000,000 to $2,500,000 according to its most recently filed IRS Form 990, and has its principal place of business, or is headquartered, in San Mateo County.

“Local Micro Non-Profit" means a Local Non-Profit with an annual revenue of less than $1,000,000, according to its most recently filed IRS Form 990, and has its principal place of business, or is headquartered, in San Mateo County.

☐ Yes

☐ No

*Response required

When equals "Yes"

4.14.8. If the Proposer is a "Small" or "Micro" Non-Profit located in San Mateo County,*

Please provide your latest filed IRS form 990. A filing from the last two calendar years is acceptable.

Include the proposer's name and the IFB title and number in each filename.