Countywide Security Assessment and Risk Analysis

San Bernardino County is soliciting proposals for a countywide security assessment and risk analysis under RFP ISD126-ADM-6361, with proposals due August 6, 2026; a mandatory virtual proposal conference was held July 16, 2026, and attendance was required.

The scope spans three prongs across 47 county departments and 16 Health Care Component (HCC) departments. Prong One is a comprehensive security assessment including vulnerability and penetration testing across up to 55,000 unique active host IP addresses, web application testing, wireless and physical security assessments, social engineering campaigns, firewall configuration reviews, and security architecture evaluations, to be completed within two months. Prong Two requires HIPAA Gap and Risk Analyses for County Fire and 16 HCC departments on a biennial cycle, with completion timelines of three to five months per HCC department. Prong Three offers department-driven optional services under a buffet pricing model. All work must be performed within the continental United States with on-site presence required at most facilities, coordinated with County escorts.

The contract term is five years, with recurring Prong Two assessments every two years and follow-up health checks scheduled six to eighteen months after initial assessments. The estimated Year One budget is $1.066750 million, representing completion of all required Prong One and Prong Two activities; pricing for subsequent years shall not exceed this amount. This is a new opportunity with no incumbent.

Proposers must submit complete responses addressing all three prongs and independently price the full scope, as the County will not provide prior HIPAA analyses or detailed IP address inventories before award. Assessment work must align with NIST standards, including NIST SP 800-30 risk methodology and NIST AI Risk Management Framework, and the County has confirmed adoption of ISO/IEC 27001 as its security control framework. Invoicing is submitted monthly in arrears; the County does not apply standard retainage pending deliverable acceptance. Specific asset quantities, network configurations, firewall platforms, and detailed social engineering parameters will be determined during Milestone One's planning phase.