Addendum2 for CRFQ CPR15*1

The State of West Virginia, on behalf of the Consolidated Public Retirement Board (CPRB) in Kanawha County, issued a Consolidated Request for Quotation (CRFQ) soliciting information security and network vulnerability assessment services to support the implementation of a new pension administration system by Deloitte Consulting LLP. The procurement encompasses five distinct security assessments conducted over a four-year initial contract period with potential for four one-year renewals, with assessments scheduled for data conversion servers, development and test environments, production migration, member self-service deployment, and the system warranty period. Deliverables include vulnerability discovery and prioritization, written reporting with executive presentations, firewall architecture and policy review, endpoint assessment, and data loss prevention gap analysis. Primary personnel must possess a minimum of five years' experience in security design and testing of Microsoft .NET, Microsoft SQL Server, and Cisco Systems Networking, with Expert or Senior level staff required to hold OSCP (Offensive Security Certified Professional) or equivalent penetration testing certification. The CPRB environment consists of approximately 80 employees with 85 Windows 7 workstations, Windows servers, Office 365, Cisco Ethernet switches, and planned expansion to include VMware 5.5, SQL Server 2012, SharePoint 2013, and MS Dynamics 2013 across multiple technical environments. Award will be based on lowest overall total cost for all five assessments submitted as firm fixed prices on a lump sum basis, with the original closing date of January 6, 2015, extended to January 15, 2015, at 1:30 p.m. EST, and a subsequent addendum deadline of January 22, 2015. Inquiries should be directed to Guy Nisbet at (304) 558-2596 or guy.l.nisbet@wv.gov, with bids submitted to the Bid Clerk at the Department of Administration Purchasing Division, 2019 Washington Street East, Charleston, West Virginia 25305.

Vendors responding to this solicitation must comply with West Virginia Code 5A-3-37 vendor preference requirements and may qualify for resident vendor preferences ranging from 2.5 to 5 percent discount consideration based on residency status and employee composition, with additional preference designations available for veteran-owned and certified nonresident small, women-, and minority-owned businesses. All bidders must complete vendor attestation forms confirming the absence of felony convictions, pending litigation related to contracted engagements, conflicts of interest including active managed security service provider contracts with West Virginia state agencies, and verification that assigned key staff are full-time employees. Vendors must also sign confidentiality agreements acknowledging the sensitive nature of information maintained by the CPRB and commit to strict non-disclosure of client and employee data including salaries, medical history, pension information, social security numbers, and banking information. The solicitation references NIST Special Publication 800-53 Revision 4 security controls, NIST SP 800-37 Risk Management Framework guidelines, SANS Consensus Audit Guidelines Critical Security Controls, and SCAP 1.2 validated security products as compliance and assessment standards. No specific budget allocation, incumbent vendor information, or award values are disclosed in the solicitation documents; contract pricing is entirely vendor-proposed and evaluated on a competitive basis for all five assessments combined.