IT SECURITY ASSESMENTS&INCIDENT RESPONSE

The contract solicitation titled IT SECURITY ASSESMENTS&INCIDENT RESPONSE, numbered 5400027903, issued by the State Fiscal Accountability Authority of South Carolina, seeks qualified vendors to provide comprehensive IT security assessment and incident response services to enhance the information security and privacy posture of all Using Governmental Units. The requirement is structured into four distinct lots: vulnerability assessments and penetration testing, security assessment remediation, IT security incident response, and privacy incident response, all delivered on an hourly rate basis with fixed pricing for the initial one-year term and four optional one-year renewals, totaling a potential five-year contract period. Offerors must submit detailed technical and business proposals, with the technical proposal capped at 30 pages excluding mandatory cover and executive summary components, and pricing information strictly prohibited from inclusion in this volume. The business proposal must include Attachment A, the Service Rate Sheet, failure to which renders the offer non-responsive, and must be submitted alongside a completed Service Provider Security Assessment Questionnaire, an ethics certificate, vendor registration, and certifications confirming compliance with applicable laws, debarment status, and organizational conflict of interest avoidance. All proposals must be submitted electronically via the state procurement portal by the deadline of July 21, 2026, and must adhere to strict formatting requirements including separation of technical and business volumes onto distinct media labeled with the solicitation number and offeror name, using either Microsoft Office or PDF formats. Evaluation will prioritize price at 40% weight, technical proposal completeness and suitability at 30%, and qualifications and past performance at 30%, with awards made to up to five top-ranked, responsible offerors per lot based on the most advantageous evaluation. Contractors must meet rigorous security and compliance standards, including verification of ISO/IEC 27001, NIST CSF 2.0, and other regulations such as HIPAA, FISMA, CJIS, GDPR, and PCI-DSS, either through third-party audits or detailed explanations if unavailable. Insurance requirements mandate general and information security liability coverage with all Using Governmental Units named as additional insureds, and the contractor assumes full indemnification responsibility for third-party claims, including intellectual property. Ongoing obligations include reporting sales and remitting administrative fees monthly, maintaining access for audits for three years post-contract, and ensuring subcontractors adhere to the same or more stringent security conditions. Delivery of services occurs at the direction of individual Using Governmental Units, following F.O.B. Destination terms, and the contractor