Cybersecurity Assessments and Services

The contract for cybersecurity assessment services issued by the Maryland Department of General Services on behalf of the Department of Information Technology is structured as a flexible, work order-based indefinite delivery/indefinite quantity (IDIQ) arrangement with an estimated total value ranging from five to fifteen million dollars. It emphasizes a comprehensive approach to cybersecurity evaluations, requiring contractors to respond to specific Work Orders with detailed technical approaches, resource allocations, and pricing, all governed by Maryland regulations and standards such as NIST, FedRAMP, and FISMA. The contract incorporates multiple exhibits and attachments, including detailed pricing templates, certifications, affidavits, and compliance forms, which are integral to proposal submission and contract administration. The procurement process prioritizes technical merit, experience, and qualifications, with a secondary focus on cost, and allows for discussions, oral presentations, and Best and Final Offers to determine the most advantageous proposal based on a trade-off analysis favoring technical excellence. Key contractual provisions include strict security and personnel requirements, such as background checks, on-site security protocols, and continuous key personnel performance, with specific procedures for personnel substitution. The contract mandates adherence to Maryland’s nondiscrimination policies, green purchasing, and socioeconomic participation goals, including MBE and VSBE certifications, which must be documented through designated affidavits and participation schedules. Deliverables are subject to inspection and acceptance by Maryland’s designated officials, with quality assurance measures aligned with NIST standards, and the contractor is responsible for internal QA processes. Payment will be made via electronic funds transfer based on properly submitted invoices containing all required information, with the contract specifying the need for detailed performance monitoring, transition planning, and compliance with security incident reporting policies. The solicitation emphasizes strict proposal submission procedures through the eMaryland Marketplace Advantage system, with separate technical and financial volumes, no explicit page limits, and mandatory attachments, all due by a specified deadline. Overall, the contract aims to provide Maryland with a robust, standards-compliant cybersecurity assessment capability, leveraging a structured yet flexible procurement framework to ensure security, quality, and socioeconomic participation.