Information Technology (IT) Security and Compliance Consulting Services

Broward County, Florida, through its Enterprise Technology Services Division, is seeking to establish a pre-qualified vendor list (QVL) for Information Technology (IT) Security and Compliance Consulting Services on an indefinite quantity, as-needed basis to serve approximately 60 County agencies. This open-end contract solicitation (PNC2131193B1) was posted February 10, 2026, with a response deadline of March 6, 2026. The procurement encompasses eight service categories: Payment Card Industry (PCI) Services; Health Insurance Portability and Accountability Act (HIPAA) Services; Information Technology Audit Services; Cyber Security Penetration Testing Services; Cyber Security Incident Response Services; Public Safety Network and Systems Audit Services; Information Technology Project Management; and Cyber Security, Risk, Regulatory, and Technology Managed Services. Vendors must demonstrate three to seven years of experience depending on the service category and possess industry-recognized certifications such as CISSP, CISM, CISA, CEH, and OSCP, with expertise in frameworks including NIST, ISO/IEC 27001, COBIT, HIPAA, and PCI DSS. Qualified personnel must be approved by the County prior to project commencement and will be subject to background checks and security clearances. Deliverables include weekly status updates, milestone reports, and comprehensive final reports within two weeks of project completion. Compensation will be based on mutually agreed hourly rates, fixed fees, or combination arrangements negotiated for individual projects, with awards made to the lowest responsive and responsible bidder. All responses must be submitted electronically through the BPRO system by the March 6, 2026 deadline, accompanied by completion of the Category, Certification, and Disciplines Worksheet without modification.

Category 7 (Information Technology Project Management) is exclusively reserved for Broward County Business Enterprise (CBE) firms, while the remaining seven categories have no specific CBE participation goals assigned. All vendors, including CBE-certified and non-CBE firms, may respond to the solicitation and compete across applicable categories. For CBE firms responding to the reserved category, a tiered monetary differential structure applies: proposals not exceeding three million dollars cannot exceed the lowest non-CBE bid by more than ten percent, while proposals exceeding three million dollars are capped at a five percent differential; additionally, CBE vendors must ensure at least 85 percent of services are performed by CBE firms either through self-performance or subcontracting with other CBEs. Vendors qualifying as Small Business Enterprises (SBEs) receive preference consideration, with SBE or CBE proposers scoring within five percent of the highest-ranked non-certified proposer considered the highest-ranked proposer for negotiation purposes. Vendors must submit extensive compliance documentation including Domestic Partnership Act Certification (for contracts exceeding $100,000), Location Certification for local business preference eligibility, Litigation History Disclosure, Anti-Human Trafficking Affidavit, and security clearance requirements including Level 1 Florida Department of Law Enforcement background checks. Insurance requirements are substantial, including General Liability ($1,000,000 per occurrence/$2,000,000 aggregate), Professional Liability/Errors & Omissions ($2,000,000 per claim/$4,000,000 aggregate), Cyber Liability ($2,000,000 per claim), and Crime/Employee Dishonesty ($1,000,000 per claim), with all policies naming Broward County as additional insured. No specific budget range or guaranteed minimum contract value is disclosed, as this is an indefinite quantity arrangement with pricing determined through individual project negotiations; the initial contract term is five years from award with options for five additional one-year renewal periods.