Plan and Execute a Tabletop Exercise of the Incident Response Plan (IRP) and Emergency Operations Plan (EOP)

Bristol Bay Borough, Alaska is issuing a Request for Proposals (RFP 25-09) to select a qualified vendor to plan and execute a tabletop exercise of the Borough's Cybersecurity Incident Response Plan (IRP) and the Cybersecurity Annex to the Emergency Operations Plan (EOP). The procurement involves collaboration with the State of Alaska's Division of Homeland Security and Emergency Management and the Cybersecurity and Infrastructure Security Agency (CISA). The vendor will be responsible for developing an exercise plan, conducting the tabletop exercise with onsite coordination, facilitating a hotwash meeting, and producing a comprehensive lessons learned document, with all deliverables provided in Microsoft Word format. Key objectives include identifying and recording gaps in existing plans, training Borough personnel on their roles and responsibilities during cybersecurity incidents, and engaging community members in emergency preparedness. The project is estimated at 120 hours of planning, coordination, execution, and documentation, with provisions for up to three travel occurrences to the Borough and 15 days of per diem; travel will be to King Salmon, AK, with lodging provided by the Borough. Required qualifications include demonstrated expertise in cybersecurity incident response, tabletop exercise facilitation, compliance with NIST Cybersecurity Framework standards, and the ability to work with multiple stakeholders including Bristol Bay management, IT support vendors, and state and federal agencies. The evaluation criteria consist of experience (30 points), depth of bench (10 points), methodology (10 points), requirements understanding (15 points), response quality (10 points), and costs (25 points), for a total of 100 possible points. Proposals are due by November 1, 2025 at 5:00 PM AST, with an estimated award date of November 28, 2025 and project completion targeted for April 30, 2026, with project initiation required by November 30, 2025.

The RFP documents do not specify set-aside designations or restrictions limiting responses to particular types of organizations, disadvantaged enterprises, or minority-owned businesses. No incumbent vendors or current contractors are identified in the available documentation. The project will require integration with the Borough's existing Microsoft Defender cybersecurity infrastructure and coordination with multiple IT support service vendors currently engaged with the Borough. Vendors must comply with specific cybersecurity standards including data encryption, multi-factor authentication, vulnerability scanning, and employee cybersecurity training, maintain cyber liability insurance, and agree to notify the Borough within 16 hours of any security breaches, with the Borough retaining the right to audit vendor cybersecurity practices. The vendor will be required to execute a Non-Disclosure Agreement with a five-year term to access the confidential IRP and EOP documents for proposal development. Specific award values or budget ranges are not explicitly stated in the available documentation; however, the vendor will propose an hourly rate for services with billing limited to actual hours and travel expenses incurred.