Incident Response, Recovery, and Cybersecurity Capacity Building Services

Cybersecurity consulting firms to provide Incident Response, Recovery, and Cybersecurity Capacity Building Services.
- Cybersecurity incidents have the potential to affect:
• Administrative operations
• Financial and business systems
• Communications
• Information technology systems
• Operational technology and SCADA
• Data availability, confidentiality, and integrity
• Continuity of District operations
- The selected consultant shall assist MCWD in:
• Evaluating current incident response readiness.
• Identifying gaps in incident response and recovery capabilities.
• Developing or updating a practical Cybersecurity Incident Response and Recovery Plan.
• Establishing clear incident response roles and responsibilities.
• Establishing incident classification and escalation procedures.
• Developing practical incident response playbooks.
• Improving internal and external cybersecurity incident communications.
• Improving coordination with vendors, insurers, public agencies, and other outside resources.
• Improving staff understanding of cybersecurity logs, alerts, and incident information.
• Improving recovery procedures associated with cybersecurity incidents.
• Training District personnel on incident response and recovery procedures.
• Conducting a cybersecurity tabletop exercise.
• Documenting lessons learned and corrective actions.
• Incorporating significant tabletop findings into the final plan.
• Transferring sufficient knowledge so District personnel can maintain and improve the plan following project completion.
• Providing concise recommendations for future improvements directly related to incident response and recovery.