Dept of Technology Qualys SaaS Informal Request For Quote

The City of Columbus Department of Technology is requesting quotes for a one-year renewal of Qualys SaaS VMDR Public Sector licensing, maintenance, and software support services under an informal RFQ, with quotes due August 21, 2026. Offerors must be authorized Qualys partner distributors to be eligible.

The renewal term runs September 16, 2026 through September 15, 2027. The City is an existing Qualys customer. The scope includes vulnerability management, detection, and response (VMDR) capabilities with a complete, fully functional turnkey system. The contractor must maintain 99.5% system availability and deliver annual independent security assessments conforming to NIST frameworks.

Compliance requirements include HIPAA, FERPA, PCI-DSS, and FBI CJIS policies. All work must be performed in the continental United States with City data maintained domestically. The contractor must obtain cyber-liability insurance of not less than $5 million per occurrence and $10 million in aggregate. The contract incorporates comprehensive cybersecurity measures including multi-factor authentication and encryption.

The contract establishes a five-year maximum term subject to annual approval and appropriation by Columbus City Council, with Year 1 pricing to remain firm throughout the contract term. The maximum obligation for Year 1 purchase orders is not to exceed an amount to be determined pending City Council appropriation authorization. Invoices are due within thirty days of City approval following issuance of a certified purchase order by the City Auditor's Office.