TIS | RFP for Cybersecurity Staffing Firms

The San Francisco Department of Technology is requesting proposals from qualified staffing firms to provide enterprise identity, directory, access governance, and cybersecurity professional services on an as-needed basis, with proposals due October 20, 2026 at 3:00 p.m. PST and a pre-proposal conference scheduled for September 30, 2026. Certified Small/Micro Local Business Enterprises (LBEs) are eligible for a 10% rating bonus, and certified SBA LBEs may receive up to 5% rating bonus depending on contract value; no LBE subcontracting requirement applies.

The scope encompasses Microsoft Active Directory, Microsoft Entra ID, Identity and Access Management (IAM), Identity Governance and Administration (IGA), Privileged Access Management (PAM), Multi-Factor Authentication (MFA), Single Sign-On (SSO), identity verification and proofing, identity lifecycle management, access governance, cloud identity, application integrations, and physical access and badging integrations. Services also include cybersecurity technical services such as architecture, remediation, defense, endpoint security, hardening, and vulnerability identification. The City seeks firms with demonstrated experience designing, implementing, integrating, migrating, securing, modernizing, and supporting complex enterprise identity environments.

The anticipated contract term is three years with an option to extend for two additional years for a total of five years, structured as an indefinite-quantity, as-needed agreement with no guaranteed minimum volume. The not-to-exceed amount for the initial three-year term is $1,000,000, based on the City's estimated spend. Hourly rates are firm for the first three years with potential for mutually agreed increases thereafter not exceeding a specified percentage in year four. Proposals will be evaluated on a 100-point basis: minimum qualifications (pass/fail), written proposal (80 points), and price proposal (20 points). The City intends to award contracts to the top four proposers meeting minimum qualifications with the highest-ranking scores. Written questions are due October 9, 2026 at 10:00 a.m. PST. A Notice of Intent to Award is anticipated by the week of November 2, 2026, with a three-business-day protest period. Contractors must maintain $5,000,000 Technology Errors and Omissions coverage and $5,000,000 Cyber and Privacy Liability coverage, comply with prevailing wage requirements for covered services, and maintain strict confidentiality of City data with prohibitions on using data to train artificial intelligence systems without prior written consent. Kenneth Edhammer is the solicitation administrator at 628-652-5093 or kenneth.edhammer@sf.gov.