Cybersecurity Master Services Agreement (MSA)

The Sacramento Municipal Utility District (SMUD) is soliciting proposals to establish a Cybersecurity Master Services Agreement (MSA) to secure a pool of qualified vendors capable of addressing evolving cybersecurity needs. The resulting contract will have an initial five-year term, with the possibility of extensions. This professional services agreement expressly excludes staff augmentation and focuses on specific deliverables, including the development of cybersecurity policies for operational technology (OT) solutions and maintaining PCI-DSS compliance through the submission of annual SAQ A and SAQ B documents. All work must adhere to the NIST Cybersecurity Framework, the Risk Management Framework (RMF), and FERC CIP standards. Award decisions will be based on a weighted evaluation prioritizing management and technical ability over price. Proposers must pass mandatory requirements and meet a minimum technical score threshold to be considered. Evaluation criteria include proposer experience and qualifications (30%), commercial terms and compliance (30%), category-specific experience (25%), SEED Program participation (10%), and environmental sustainability (5%). To ensure security, all tasks must be performed by US-based personnel with no offshore resources permitted. Successful contractors must execute a Non-Disclosure Agreement and provide insurance certificates within fifteen days of the award.