Cybersecurity Products and Services

The vendor is required to provide cybersecurity products and services to safeguard the confidentiality, integrity and availability of information systems and data as outlined in this solicitation for 1gpa cooperative members as needed.
- Cybersecurity and data governance products and services
1. Identity and access management (IAM)
•    Access control
•    Privileged access management (pam)
•    Single sign-on (SSO)
•    Policy management
2. Threat detection, prevention and response
•    Advanced persistent threat (apt) protection
•    Cyber threat intel
•    Deception technology
•    User and entity behavior analytics (UEBA)
•    Insider threats
3. Network and endpoint security
•    Endpoint detection response (EDR)
•    Distributed denial of services (DDOS) and denial of services (dos)
•    Domain name system (DNS) poisoning
•    Wi-Fi security
•    Bot defense
4. Cloud and application security
•    Mobile application security
•    App/extension risk
•    Cross-scripting
•    Cloud security
5. Governance and risk
•    Risk characterization
•    National institute of standards and technology (NIST) auditing
•    Center for internet security (cis) controls
•    Vendor risk
6. Data protection
•    Encryption
•    Data loss prevention (DLP)
•    Data-centric security
•    Storage and archiving
•    Retention
7. Automation and analytics
•    Artificial intelligence (AI) security
•    Data ingestion (e.g., data pipeline and correlation for services for threat intelligence)
•    Security orchestration
8. Implementation and integration services
•    System set-up, configuration and tuning
•    Integration with existing it systems (e.g., active directory, cloud services, security information and event management (SIEM))
•    Application programming interface (API) development or third-party tool integration
•    Role-based access and identity control setup
•    Device and platform compatibility assessments
9. Technical support and maintenance
•    24/7 help desk or incident support
•    Patch management and update services
•    Product performance monitoring
•    Backup and recovery testing
10. Incident response and forensics
•    Incident containment and remediation
•    Forensic investigation and root cause analysis
•    Legal and regulatory response coordination
•    Post-incident reporting and future mitigation planning
- Cybersecurity consulting services
1. Risk assessment and security program review
•    Penetration testing and vulnerability exploitation: perform comprehensive penetration testing across all systems and devices accessible to the member’s network. 
•    This includes simulating apt actors using both automated and human-driven tactics. 
•    Assess the impact of exploited vulnerabilities, lateral movement potential and data exfiltration risks. 
•    Wireless and IoT security evaluation: identify rogue wireless access points and assess weaknesses in wireless configurations. 
•    Evaluate the security of IoT systems such as HVAC, cctv, vehicles and smart transit infrastructure. 
•    Cloud security posture assessment: review configurations in cloud platforms such as microsoft 365, google workspace or AWS. 
•    VoIP and network component review: review voice-over-IP (VoIP) system configurations and components for known vulnerabilities and misconfigurations. 
•    Third-party risk review: evaluate vendor integrations and potential exposure from outsourced services or applications. 
•    Asset health and compatibility assessment: assess internal hardware and software compatibility, integration, authenticity, reliability, patch currency and overall lifecycle risks. 
•    Regulatory compliance evaluation: assess the member’s systems and policies for compliance with applicable federal and state requirements including but not limited to:
o    Health insurance portability and accountability act (HIPAA)
o    Family educational rights and privacy act (FERPA)
o    2 CRF §200.79 – personally identifiable information (PII)
•    Disaster recovery and business continuity review: evaluate the adequacy and maturity of disaster recovery and incident response policies and procedures. 
•    Organizational security culture and policy adherence: assess the organization’s security posture, including employee compliance with internal policies and procedures. 
•    Assess training effectiveness and awareness levels. 
•    Conduct phishing or social engineering assessments to evaluate staff readiness. 
•    Reporting and recommendations: provide a comprehensive report detailing validated findings, associated risk levels (e.g., critical, high, medium, low) and recommended mitigation strategies aligned with industry best practices
2. Project development and management
•    Strategic research and planning: conduct research on current cybersecurity threats, best practices, emerging technologies and risk mitigation strategies. 
•    Recommend the most efficient and cost-effective methods to protect member’s infrastructure, including systems, networks, applications and data assets. 
•    Project prioritization and planning: develop a prioritized list of recommended projects based on risk level, budget constraints and operational impact. provide the following for each recommended initiative:
o    Estimated project cost
o    Task-level work breakdown
o    Schedule with key milestones
o    Resource and dependency mapping
•    Procurement and contract support: 
o    Advising on cooperative and direct purchasing options
o    Drafting scopes of work and functional requirements
o    Assisting in the development of evaluation criteria for solicitations and vendor proposals
o    Project execution and oversight: 
•    Performing site inspections or remote validations
o    Testing system functionality and integration
o    Maintaining project schedules and budget allowances
o    Providing written progress reports at intervals agreed upon with the member
•    Security architecture design:
o    Industry best practices
o    Organizational needs and interoperability
o    Current and future cybersecurity controls
•    Change management and training: 
o    Assist with end-user training, communication strategies and policy updates related to new system rollouts or cybersecurity upgrades.
•    Post implementation review: 
o    Conduct a project close-out review to verify that all deliverables have been met, assess lessons learned and recommend follow-up actions for continuous improvement.

- Contract Period/Term: 1 year
- Questions/Inquires Deadline: August 22, 2025