Cybersecurity Risk Assessment — Water and Wastewater Systems

The City of Ogdensburg, New York is requesting proposals for a comprehensive cybersecurity risk assessment of its municipally owned drinking water and wastewater systems, with proposals due November 20, 2026 at 4:00 PM Eastern. This procurement is funded through a New York State Environmental Facilities Corporation SECURE Program Assessment Grant and must evaluate the City's cybersecurity posture against New York Department of Environmental Conservation and Department of Health regulations effective March 1, 2026.

Proposers must demonstrate experience performing at least three similar cybersecurity assessments within the past five years and possess working knowledge of NIST Cybersecurity Framework 2.0 and applicable state regulations. Assigned staff must hold relevant credentials such as CISSP, CISM, GICSP, or CEH. Proposers and subcontractors must be eligible to contract with New York municipalities and certify they are not listed as ineligible under New York Labor Law 220-b or Executive Law 316.

The scope includes project initiation and data collection, current profile risk and vulnerability assessment using NIST CSF 2.0 and CIA Triad methodology, target profile development with regulatory gap analysis, and a prioritized remediation roadmap. Deliverables comprise a draft assessment report (due within 120 calendar days of notice to proceed), an executive summary, and a final report with presentation (final due within 60 calendar days of City comments). The assessment covers both water and wastewater systems combined.

The not-to-exceed budget is $45,000 all-inclusive, covering labor, travel, subconsultant costs, materials, and report production. Funding disburses in two phases: 50 percent upon contract execution and 50 percent upon EFC acceptance of the completed assessment. No MWBE, SDVOB, or DBE contracting goals apply under EFC SECURE Program guidance, though the City encourages minority-, women-owned, and service-disabled veteran-owned business participation. Written questions are due October 22, 2026 at 4:00 PM Eastern; addenda will be issued by October 30. Anticipated award notification is January 2027, with contract execution and notice to proceed in February 2027. Evaluation criteria weight technical approach and understanding of NIST CSF 2.0 at 30 percent, firm qualifications and experience at 25 percent, cost proposal at 20 percent, key personnel qualifications at 15 percent, and schedule compliance at 10 percent.