Cybersecurity Assessments and Services

The State of Maryland, through the Department of Information Technology (DoIT), is procuring a variety of cybersecurity services including assessments, penetration testing, authorization to operate (ATO) programs, and architecture, engineering, and program services. The RFP seeks to award up to six contracts, with one contractor per category for categories 1-3 and up to three contractors for category 4. Key deliverables include conducting approximately 70 cybersecurity assessments within 12 months, developing and executing an adversary emulation program, implementing an ATO program, and providing general cybersecurity architecture, engineering, and program services. Offerors must demonstrate qualifications and past experience in the specific service categories they propose on. Proposals are due by January 23, 2023, and awards will be made for a base period of 4 years with 4 one-year renewal options.

The procurement has a 20% Minority Business Enterprise (MBE) subcontracting goal, but no Veteran-Owned Small Business Enterprise (VSBE) subcontracting goal. The RFP does not identify any incumbent contractors, as this is the first time these services are being procured by the state. Pricing will be on a fixed-price or labor-hour basis, but the RFP does not specify a predetermined budget or spend amount, as this is the first of its kind for the state. Offerors may propose on multiple categories, but an award in category 4 precludes an award in any other category.