Cybersecurity Policy Review Services

The vendor required to provide cybersecurity policy review services for include:
- Discovery and current state assessment
•    Kick-off meeting: a foundational meeting with agency stakeholders to confirm project scope, define objectives, establish communication protocols, and finalize the project timeline.
•    Policy workshops (up to 60 minutes each): conduct interactive virtual workshops with agency techno review logy staff to:
o    Thoroughly understand and document agency specific cybersecurity requirements, operational context, and strategic objectives.
o    Inventory and document the complete set of existing agency IT policies and procedures.
•    Current state analysis and gap identification:
o    Perform a comprehensive review of all current agency policies. 
o    Identify and document specific gaps, weaknesses, or areas for improvement within existing policies. 
o    Define and document a prioritized list of agency or critically required policies to align with cybersecurity best practices and agency information security strategy.
- Policy development and refinement
•    Policy review and feedback: provide a detailed report outlining necessary changes to existing policies, including specific recommendations for updates to align with cybersecurity best practices and industry standards. 
•    New policy drafting: develop and draft up to ten (10) new, essential cybersecurity policies tailored to agency unique environment and strategic needs. 
•    These drafted policies will be presented for consideration by the Exeter-west committee policy subcommittee. 
•    Collaborative policy finalization: work iteratively with agency administration to review, refine, and finalize all newly drafted and updated policies.
•    Policy recommendation: present the finalized suite of policies to the agency policy subcommittee for formal recommendation and adoption.

- Questions/Inquires Deadline: December 15, 2025