RFP-CIP Enterprise Security Awareness Training

The Michigan Department of Technology, Management and Budget (DTMB) issued a Request for Proposal (RFP) for an enterprise security awareness training SaaS solution designed to serve approximately 60,000 State of Michigan employees and contractors. The procurement seeks a vendor-hosted platform providing general security awareness training upon hire, quarterly enterprise-wide security awareness training, simulated phishing email exercises, and role-based security courses that comply with Federal Information Security Modernization Act (FISMA) and National Institute of Standards and Technology (NIST) standards. The solution must support up to 50,000+ state employees and 10,000+ approved third-party contractors with unlimited concurrent users and maintain 99.98 percent availability. Evaluation will be based on technical criteria (30 percent), solution requirements and specifications (40 percent), staffing (15 percent), and company background (15 percent); proposals scoring 80 or more points will advance to pricing evaluation. Key deadlines include a bidder questions deadline of Monday, April 27, 2026, with answers posted by May 4, 2026, and a proposal submission deadline of 11:59 a.m. Eastern on Tuesday, May 26, 2026, with an anticipated contract start date of Thursday, December 17, 2026. The contract term comprises five base years with five one-year renewal options for a potential total of ten years.

The RFP does not specify set-aside designations or restrictions limiting eligible respondents to specific organization types or disadvantaged enterprises. No incumbent vendor or current contractor information is identified in the solicitation. The contractor must provide a comprehensive pricing schedule including licensing fees, annual support service fees, hosting fees, implementation fees, and a rate card for ancillary professional services, with all pricing remaining firm for the initial contract period and no fee increases permitted. Contractor compliance is mandatory regarding Data Security Requirements, Service Level Agreements, insurance requirements, and disaster recovery and transition plans, with no offshore resources permitted for positions accessing State data. No specific contract value or budget range is disclosed in the available documentation, with award anticipated to the responsive and responsible bidder offering the best value as determined through the evaluation criteria.