Cyber Security and Incident Planning

Galveston County, Texas, is seeking a comprehensive cybersecurity and incident planning solution through Request for Proposal (RFP) #25-060, with proposals due on September 18, 2025, at 2:30 PM CST. The county aims to establish a robust security management governance structure that includes defined roles, responsibilities, policies, and accountability for both the Information Technology division and the county's user community. Key deliverables include a formal cybersecurity governance framework utilizing NIST and SANS Institute standards, documented roles and responsibilities, and comprehensive continuity of operations and disaster recovery plans addressing cyber security incidents, manmade disasters, and natural disasters. The evaluation criteria will assess vendors based on Experience & Qualifications (25%), Project Team Members (10%), Methodology (30%), Litigation (5%), Cost (25%), and References (5%), with a preference for vendors experienced in local government cybersecurity work in Texas. Potential bidders must address the county's complex technical environment, which includes physical and virtual servers, end-user workstations, and secure inter-site connectivity, while ensuring compliance with HIPAA, CJIS, and TXDIR requirements.

The procurement does not specify explicit set-aside designations or restrictions on respondent types. The project has a total budget of $92,000, with partial funding from a state grant, and is structured as a one-year contract with an optional one-year extension. Galveston County operates multiple locations with approximately 1,300 employees and a technology staff of about 40, including a Security Operations Center. The successful vendor must develop governance, policy, and plans aligned with NIST Cybersecurity Framework (CSF) 2.0, CIS Critical Security Controls, and applicable AI governance frameworks such as the NIST AI Risk Management Framework. The county will utilize the Bonfire Interactive e-procurement portal for electronic submissions, though walk-in and mailed proposals are also accepted. Pricing must include all costs, with the county being tax-exempt, and vendors must meet specific insurance requirements, including general liability coverage with minimum limits of $100,000 per person, $300,000 per occurrence for bodily injury, and $100,000 for property damage.