Statewide Cybersecurity Resources

The State of Maryland Department of General Services is requesting proposals for statewide cybersecurity resources under RFP BPM057598, with proposals due October 2, 2026, at 2:00 PM ET (extended from September 18 via Amendment 2). This is a multiple-award procurement with up to six contracts available — no more than two per functional area — structured as an indefinite quantity contract with firm fixed hourly rates and work orders. Offerors may respond to only one functional area: Oversight and Governance; Architecture, Engineering, and Implementation; or Protection and Defense.

MBE subcontracting goals are set at 15 percent and VSBE goals at 3 percent for each functional area. Failure to complete and submit required MBE and VSBE forms results in proposal rejection. All VSBEs must be certified and registered on Maryland's eMMA platform at proposal submission. When a VSBE serves as prime contractor, it may receive credit for up to 100 percent of the VSBE goal for work performed with its own workforce.

The scope encompasses cybersecurity labor across 23 labor categories in Oversight and Governance (policy, GRC, risk management, compliance, privacy, training); 24 categories in Architecture, Engineering, and Implementation (architecture, DevSecOps, cloud security, identity and access management, platform administration); and 26 categories in Protection and Defense (SOC analysts, vulnerability analysts, threat intelligence). Offerors must price three seniority levels (Junior, Mid, Senior) for each labor category at fully loaded hourly rates including all labor, profit, overhead, and administrative costs. No minimum or maximum contract hours is guaranteed. The contract term is ten years with no renewal options. Work is performed at various locations throughout Maryland, with state data processing and storage restricted to the United States only.

The pre-proposal conference was held August 11, 2026; written questions were due August 17. Amendment 1 attached conference attendance and presentation materials. Amendment 2 clarified submission requirements and struck Attachments L (Reference Checks) and Q (Labor Resume Form), requiring reference letters and resumes to be submitted during work order phases instead. Proposals must be submitted in two separate volumes via eMMA — Volume I (Technical) and Volume II (Financial) — with commingled responses deemed non-susceptible for award. Technical and financial factors are weighted equally. A down-select process will advance the six most advantageous proposals in each functional area to the next phase of technical evaluation based on past performance and reference letters.

Evaluation criteria include offeror's understanding of functional area scope, qualifications and capabilities of proposed staff and subcontractors, demonstration of success in resource sourcing, economic benefit to Maryland, and MBE/VSBE participation. Offerors must submit economic benefits as contractually enforceable commitments with quarterly reporting requirements. Required insurance includes $1 million commercial general liability, $5 million cyber security/data breach coverage, and workers' compensation. Contractors must comply with Maryland's Living Wage Law (Tier 1 or Tier 2 rates depending on service location), System Development Life Cycle methodology, Scaled Agile Framework or PMBOK, and comprehensive security requirements including FIPS 140-3 encryption, CIS hardening, daily log reviews, 30-day vulnerability remediation, and one-hour incident reporting to the Maryland Security Operations Center. Contractors bear all investigation, notification, credit monitoring, and remediation costs for data breaches. All security and contractual provisions must flow down to subcontractors and survive contract termination. Contractors must remit a one percent electronic transaction fee monthly on invoiced amounts within 45 days of each reporting period end.