Cybersecurity Risk Assessment for Information Security

The Maryland Judiciary's Administrative Office of the Courts (AOC), on behalf of Judicial Information Systems (JIS), is soliciting a small procurement for consulting services to perform two cybersecurity risk assessments of the Maryland Judiciary's existing information security controls and practices serving approximately 5,000 employees across all Circuit and District Courts. Offerors must conduct assessments measuring implemented controls and practices against the NIST Cybersecurity Framework (CSF) version 2.0 across six control categories (Govern, Identify, Detect, Protect, Respond, and Recover), perform Implementation Tiers assessments, and perform gap analyses against NIST 800-171 and NIST 800-53 controls. Assessment #1 deliverables are due by March 31, 2027, and Assessment #2 deliverables are due by March 31, 2029, with Assessment #2 commencing no earlier than one fiscal year after Assessment #1 completion. Required deliverables include Executive Reports, Technical Reports, virtual presentations, and mapping documentation, all provided in non-proprietary formats such as Microsoft Word, Excel, and PDF. Offerors must have a minimum of five years of experience performing cybersecurity risk assessments of similar size and scope, with work performed remotely by U.S.-based personnel. The contract will be awarded on a Labor Hour, Not to Exceed (NTE) basis to the responsible Offeror submitting the proposal most advantageous to the AOC based on evaluation criteria in descending order of importance: price, extent to which the response meets overall requirements, Offeror experience and references, and key personnel experience and qualifications. Proposals are due electronically through the Maryland Judiciary Procurement Portal by April 13, 2026, with the Procurement Officer (Pamela Malech, 410-260-1260, Pamela.Malech@mdcourts.gov) serving as the sole point of contact.

There are no MBE or VSBE set-asides specified, though such enterprises are encouraged to respond. The previous cybersecurity risk assessment was completed in late 2024/early 2025 under solicitation K24-0085-29 and was awarded to Enterprise Risk Management, Inc., dba ERMProtect on June 28, 2024 for $45,000. The successful Offeror must maintain minimum insurance coverage including Commercial General Liability ($1,000,000 combined single limit per occurrence/$2,000,000 annual aggregate), Workers' Compensation ($500,000 per accident and per disease), and Professional Liability/Errors & Omissions ($1,000,000 per occurrence/$2,000,000 annual aggregate). Offerors must comply with the Judicial Information Systems Information Security Policy and execute a Non-Disclosure Agreement protecting all confidential information, with breach penalties of $1,000 per unauthorized disclosure plus injunctive relief and indemnification for all losses. All contractor personnel accessing confidential information must sign the agreement and be listed on a required exhibit, with subcontractors implementing equivalent confidentiality protections. While the specific budget for this procurement is not explicitly stated in the solicitation documents, the previous assessment was valued at $45,000, which may serve as a reference point for anticipated award values.